F5 vulnerability highlights weak points in DHS’s CDM program

CISA issued an emergency directive after F5 revealed a nation-state had gained a long-term foothold in its systems, forcing federal agencies to inventory and patch thousands of F5 instances; the story highlights shortcomings in the Continuous Diagnostics and Mitigation (CDM) program—especially limited visibility for edge devices like BIG‑IP load balancers—and describes how those visibility gaps complicated the government-wide response and prompted interagency coordination.