F5 Says Nation-State Actor Held Long-Term Access and Took BIG-IP Source Code

On 15 October 2025 F5 disclosed that a nation-state threat actor had conducted a significant long-term compromise of its corporate networks. The actor stole source code from the BIG-IP product suite and information about vulnerabilities that had been discovered but not yet disclosed or patched.

BIG-IP appliances sit in front of a very large share of enterprise and government applications, terminating traffic and handling authentication. US authorities issued directives to federal agencies in response.

This desk was careful at Trellix in 26-0504 to say that source code is not a signing key, and that reading code does not let anyone push an update. That remains true here.

What is different is the second category. A vendor’s internal list of known-but-unpatched vulnerabilities is a set of working zero-days with the analysis already done. It removes the expensive part of vulnerability research and hands the actor a queue of flaws whose fixes are, by definition, not yet deployed anywhere.

The multi-vendor perimeter campaign filed at 26-0311 described why this device class keeps failing: internet-facing by necessity, parsing hostile input before authentication, running firmware customers cannot inspect, excluded from endpoint monitoring.

An actor holding the vendor’s own vulnerability backlog for that class of device is positioned upstream of every one of those campaigns.

A security vendor stating publicly that a state actor was inside its network long-term, and that undisclosed vulnerability data was taken, is a disclosure with obvious commercial cost and no regulatory requirement to be that specific.

It is what let customers act. Compare the Trellix claim at 26-0504, which this desk graded low precisely because nothing was confirmed — the difference between the two files is entirely a difference in what the vendor was willing to say.