Week of October 13, 2025: F5 Breach Disclosure and CISA's Emergency F5 Directive

Security leaders focused on F5's disclosure of a nation-state intrusion into its BIG-IP development environment and on CISA's Emergency Directive 26-01 ordering federal agencies to patch exposed F5 devices. CISA also added six vulnerabilities to its Known Exploited Vulnerabilities Catalog, published fourteen industrial-control-system advisories, and RAD Security named Raj Umadas as its new Chief Information Security Officer.

F5 Discloses Nation-State Breach of BIG-IP Development Systems

On October 15, 2025, F5, Inc. filed an SEC Form 8-K disclosing that a nation-state threat actor had gained unauthorized, long-term persistent access to its BIG-IP product development environment and engineering knowledge management platform, beginning August 9, 2025. The intruder exfiltrated files containing portions of BIG-IP source code and information on undisclosed vulnerabilities. The U.S. Department of Justice had authorized a disclosure delay on September 12, 2025. In the same filing, F5 reported that board member Michael Montoya resigned from the Board on October 9, 2025 and was appointed Chief Technology Operations Officer effective October 13, 2025. (SEC EDGAR / F5, Inc.)

CISA Issues Emergency Directive 26-01 for F5 Devices

On October 15, 2025, CISA issued Emergency Directive 26-01 ordering Federal Civilian Executive Branch agencies to inventory F5 BIG-IP hardware and software, assess whether management interfaces faced the public internet, and apply vendor patches after determining that a nation-state actor had compromised F5 systems and exfiltrated BIG-IP source code and vulnerability data. Agencies had to update F5OS, BIG-IP TMOS, BIG-IQ, and BNK/CNF by October 22, 2025, disconnect end-of-support devices, and submit a complete inventory to CISA by 11:59 p.m. EDT on October 29, 2025. (CISA)

CISA Adds Adobe Experience Manager Flaw to KEV Catalog

On October 15, 2025, CISA added CVE-2025-54253, an Adobe Experience Manager Forms code execution vulnerability, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The addition triggered Binding Operational Directive 22-01 remediation deadlines for Federal Civilian Executive Branch agencies, which must patch catalog entries by their assigned due dates. CISA urged all organizations, not only federal agencies, to prioritize remediation of this vulnerability given its established use as an attack vector against Adobe Experience Manager Forms deployments. (CISA)

CISA Adds Five More Vulnerabilities to KEV Catalog

On October 14, 2025, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: flaws in SKYSEA Client View, Rapid7 Velociraptor, two in Microsoft Windows tracked as CVE-2025-24990 and CVE-2025-59230, and IGEL OS. Federal Civilian Executive Branch agencies were required under Binding Operational Directive 22-01 to remediate the listed CVEs by their assigned due dates. CISA later revised the catalog, removing the Rapid7 Velociraptor entry after determining insufficient evidence of active exploitation. (CISA)

CISA Publishes Thirteen Industrial Control Systems Advisories

On October 16, 2025, CISA released thirteen Industrial Control Systems advisories covering products from Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics, including FactoryTalk View Machine Edition, FactoryTalk Linx, SiPass Integrated, SINEC NMS, and MACH GWS. The advisories detailed vulnerabilities and mitigations affecting systems used across manufacturing, energy, and building-management environments. CISA encouraged ICS operators and administrators to review the technical details for applicable devices and apply recommended mitigations to reduce exposure. (CISA)

CISA Releases Rockwell Automation EtherNet/IP Advisory

On October 14, 2025, CISA released a single Industrial Control Systems advisory addressing the Rockwell Automation 1715 EtherNet/IP Communications Module, providing technical detail on vulnerabilities identified in the device. The advisory formed part of CISA's ongoing disclosure of ICS security issues meant to help asset owners and operators in critical infrastructure sectors identify and mitigate risks tied to industrial networking equipment used for remote communications and control. (CISA)

RAD Security Names Raj Umadas as CISO

In its October 13, 2025 Industry Moves roundup, SecurityWeek reported that AI and cloud security company RAD Security had appointed Raj Umadas as Chief Information Security Officer. Umadas previously led security efforts at companies including Spotify, Squarespace, Etsy, and ActBlue Technical Services. The same roundup noted that web development platform Vercel had hired Talha Tariq, formerly CISO and CIO at HashiCorp and CTO of Security at IBM following its acquisition of HashiCorp, as its new CTO of Security, reflecting continued movement among cybersecurity leadership roles reported in mid-October 2025. (SecurityWeek)