CISA warns of imminent risk posed by thousands of F5 products in federal agencies

Federal cyber authorities issued an emergency directive after F5 reported unauthorized access to its internal systems on Aug. 9 that resulted in theft of BIG-IP source code and details of vulnerabilities. The Cybersecurity and Infrastructure Security Agency (CISA) directed federal agencies to apply F5 patches, disconnect unsupported devices, and provide inventories by Oct. 22; officials say a nation-state actor maintained long-term persistent access but have not disclosed how access was gained or named the actor.