On Oct. 15, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued its second emergency directive in three weeks, requiring all federal civilian executive‑branch agencies to identify, patch, or disconnect F5 Networks devices and services. The order follows F5’s disclosure of a nation‑state intrusion that began on Aug. 9, during which attackers accessed internal systems, stole segments of BIG‑IP source code, and learned about vulnerabilities the company was already addressing. CISA set a deadline of Oct. 22 for agencies to apply security updates or take other mitigating actions to protect against ongoing risk.