buildOne report1 publisher F5 published CVE-2026-94127, a CVSS 9.8 heap overflow in BIG-IP APM that lets an attacker run code without credentials. Only virtual servers that pair an access policy with an OAuth Authorization Server profile are exposed, so the configuration check comes first.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence64
buildOne report1 publisher F5 and Cisco say attackers are exploiting flaws in BIG-IP APM and ISE, two of the three security products in Canada's September 2026 Cyber Centre alerts. Three alerts are too few to show a trend in attacker targeting, but the two exploited products need fixed software now.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence50
Anthropic's leaked S-1 warns AI could resist shutdown or game tests, and only agent-control startups have found acquirers, Cyera paying $1 billion for Oasis. Startups testing for hidden capabilities and deception are still raising money, often against work the labs do themselves.
Publishers:cbinsights.com
Reality
- Evidence35
- Adoption35
- Hype gap+10
- Incentives55
- Confidence35
TASK#STOMP, a Windows backdoor researchers dissected, uploads a victim's business documents and then stays to copy each new or edited one. Loss from a single infection keeps growing until someone finds and removes it.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence45
Sophos says the code patches Apache and hooks the PHP module loader so the shell never lands on disk, which leaves file-integrity checking on an appliance that was never running EDR unable to prove much.
Perspective Coverage
6 publishers
- Builder
- Builder 37%
- Operator
- Operator 57%
- Investor
- Investor 6%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence70
Two actor classes are using CVE-2026-20079 against the console that manages every Cisco Secure Firewall behind it. The same week brought a Linux rootkit planted on F5 BIG-IP APM appliances, with the installation route unreported.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence55
F5 disclosed CVE-2026-94127 on September 22 with hotfixes and evidence of exploitation. It is a data plane heap overflow, so a locked-down management interface still leaves the system exploitable, and federal agencies had until September 25.
Perspective Coverage
6 publishers
- Builder
- Builder 19%
- Operator
- Operator 64%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption40
- Hype gap+10
- Incentives30
- Confidence75
watchTowr diffed two builds of BIG-IP's tmm64 and found that F5's fix for CVE-2026-94127 is a single length test on the Authorization header, a field parsed at the edge. watchTowr says attackers were already exploiting it.
Reality
- Evidence62
- Adoption20
- Hype gap+18
- Incentives55
- Confidence55
Check Point says a handful of its customers have already been attacked through the Security Management Server, and F5 confirmed exploitation of BIG-IP APM when it disclosed the bug on September 22.
Reality
- Evidence78
- Adoption55
- Hype gap−8
- Incentives62
- Confidence72
Forrester counts eight acquirers and upwards of $2.0bn of AI security tuck-ins in 18 months. It also tells CISOs to ask their vendors whether the bought capability will be bundled into the platform or sold separately.
Publishers:forrester.com
Reality
- Evidence36
- Adoption30
- Hype gap+26
- Incentives62
- Confidence44
F5 Labs logged more than 800 attacks and about 32,000 raw events against its honeypots in a month, using an April bypass of Vite's server.fs.deny to read .env files, cloud credentials and terraform.tfstate.
Perspective Coverage
3 publishers
- Builder
- Builder 42%
- Operator
- Operator 51%
- Investor
- Investor 7%
Reality
- Evidence62
- Adoption45
- Hype gap+20
- Incentives55
- Confidence66
buildConfirmed2 publishers F5 counted about 32,000 events in August aimed at .env files and cloud credentials on internet-reachable Vite development servers. The fixed builds are 7.3.2 and 8.0.5, and the advice pairs them with binding the server back to localhost.
Publishers:dev.to · f5.com Reality
- Evidence62
- Adoption42
- Hype gap+15
- Incentives58
- Confidence66
Hunt.io says a threat actor left 298 files in an open directory in Thailand, including FortiGate and F5 exploit scripts written for 3BB and a MeshCentral backdoor that the cleanup script checked was still running.
Reality
- Evidence55
- Adoption30
- Hype gap+18
- Incentives60
- Confidence50
JPCERT/CC's 2026-03-30 alert asks BIG-IP APM operators to apply the fix and then check whether the box was already compromised, because F5 now rates its October denial-of-service bug as unauthenticated code execution under attack.
Publishers:jpcert.or.jp
Reality
- Evidence68
- Adoption42
- Hype gap−12
- Incentives32
- Confidence66
Sygnia says the actor pivoted from vCenter into ESXi on stolen vpxuser credentials, left backdoors that survive reboots, and terminated vmsyslogd so the hosts stopped writing an audit trail while containment ran.
Reality
- Evidence55
- Adoption35
- Hype gap+15
- Incentives70
- Confidence50
Tenable and SentinelOne agree 79% on which edge vendors are being exploited, and barely at all on which CVEs. That asymmetry is the finding, and it reorders the patch queue.
Reality
- Evidence55
- Adoption64
- Hype gap+22
- Incentives80
- Confidence52