U.S. officials have warned that government networks are being targeted by a nation-state cyber threat actor exploiting vulnerabilities in products made by F5, a major cybersecurity and networking firm. The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive ordering federal agencies to locate and patch affected systems immediately.
According to CISA, hackers compromised F5’s internal systems, stealing files that included portions of its source code and information about undisclosed vulnerabilities. Officials said the stolen data could serve as a blueprint for future intrusions, enabling attackers to breach F5 devices and potentially gain full control over government or corporate networks.
“The cyber threat actor presents an imminent threat to federal networks,” said Nick Andersen, CISA’s Executive Assistant Director for Cybersecurity. He urged all organizations using F5 products to apply updates urgently, warning that the risk extends “to every organization and sector.”
F5 said it discovered unauthorized access on August 9 and quickly took “extensive actions” to contain the breach, engaging outside experts including CrowdStrike, Mandiant, and NCC Group. The company said there was no evidence its software development processes were tampered with, and operations remain unaffected. However, information from a few customers was accessed, and those affected have been contacted.
The U.S. Department of Justice delayed public disclosure of the breach until September 12 for national security reasons. The UK’s National Cyber Security Centre also issued a parallel warning urging users to install security updates.