erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: October 15, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Patch this week: F5 source code breach. Anyone running BIG-IP (especially with APM access policies or APM as an OAuth authorization server), F5OS, BIG-IQ or end-of-support F5 hardware.
  • Do you run any of these? Adobe Experience Manager (AEM) Forms. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-11-05.
  • npm: 1 critical advisory (happy-dom). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Breach · CVE-2025-53521, CVE-2026-94127

F5 Breach: Nation-State Stole BIG-IP Source Code

The breach itself needs no new action a year on, but its aftermath does: two unauthenticated BIG-IP APM RCEs are now on CISA's exploited list, so every BIG-IP owner should be on current fixed builds with management interfaces off the internet.

Must act: Anyone running BIG-IP (especially with APM access policies or APM as an OAuth authorization server), F5OS, BIG-IQ or end-of-support F5 hardware.

Can relax: Organizations with no F5 products, and NGINX or F5 Distributed Cloud users, whose source code F5 says was not taken.

  1. Inventory every BIG-IP, F5OS, BIG-IQ and BNK/CNF instance, physical and virtual
  2. Confirm no management interface (TMUI/SSH) is reachable from the internet
  3. Upgrade to the fixed builds in F5 K000156741 and K000162605; apply F5's iRule mitigation for CVE-2026-94127 only as a stopgap

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-54253Adobe Experience Manager (AEM) Forms
Adobe Experience Manager Forms Code Execution Vulnerability		2025-11-05

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 1

Check: npm audit (or: npm ls <package>)