F5 Networks has released urgent security updates after confirming a state-sponsored compromise on August 9, 2025, in which attackers stole source code and information on undisclosed BIG-IP vulnerabilities. Although the company found no evidence that the stolen flaws were exploited or that its software supply chain was compromised, it issued patches addressing forty-four (44) vulnerabilities across BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients. F5 advised customers to update immediately and enhance monitoring through SIEM integrations and administrative login alerts. Following the disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued emergency directive ED 26-01, mandating that all Federal Civilian Executive Branch (FCEB) agencies patch affected F5OS, BIG-IP TMOS, BIG-IQ, and BNK/CNF systems by no later than October 22. All other F5 products must be patched by no later than October 31. CTIX analysts also urge administrators to follow the guidance and remove unsupported, public-facing devices. The directive highlights the ongoing exploitation risk, as BIG-IP vulnerabilities remain prime targets for both nation-state and cybercriminal groups seeking lateral movement, credential theft, and persistence within networks.