F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen
F5 BIG-IP (vendor breach)
F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.
Why this severity: Nation-state theft of source code and undisclosed vulnerability info; CISA Emergency Directive
- Started
- Aug 9, 2025
- Closed
- Oct 15, 2025
Affected
- BIG-IP, F5OS, BIG-IP Next and others (see F5 K000154696 and Oct 2025 Quarterly Security Notification)
Fixed in
- F5 October 2025 Quarterly Security Notification releases
Timeline3
Advisories3
Notes & caveats
Attribution to UNC5221/BRICKSTORM comes from third-party reporting; F5 itself said only 'nation-state'. The Aug 9 discovery date is from F5's disclosure.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
