F5 releases BIG-IP patches for stolen security vulnerabilities

Cybersecurity company F5 has released security updates to address BIG-IP vulnerabilities stolen in a breach detected on August 9, 2025. The company disclosed today that state hackers breached its systems and stole source code and information on undisclosed BIG-IP security flaws. F5 added that there's no evidence the threat actors leveraged the undisclosed vulnerabilities in attacks and said it has not yet found evidence that the flaws have been disclosed. Today, F5 has issued patches to address 44 vulnerabilities (including the ones stolen in the breach) and urged customers to update their systems as soon as possible. F5 confirmed to BleepingComputer that "today's security updates do address impact from the incident." "Updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients are available now. Though we have no knowledge of undisclosed critical or remote code execution vulnerabilities, we strongly advise updating your BIG-IP software as soon as possible," the company said. "We have no evidence of modification to our software supply chain, including our source code and our build and release pipelines [..] and we are not aware of active exploitation of any undisclosed F5 vulnerabilities." F5 also issued guidance to help secure F5 environments from cyberattacks, which they say includes the release of the October 2025 security updates. The company advised admins to enable BIG-IP event streaming to their security information and event management (SIEM) softwa...