Cyber, in brief

F5, a US company that sells equipment for running and guarding the traffic into company networks, said on Tuesday that attackers are using a flaw in one of its products. [1]

The product is BIG-IP APM, the part of the box that lets staff log in to their company's network from outside. [1]

The flaw lets an attacker run their own commands on the box from across the internet. [1]

It is a zero-day: attackers found it and used it before any fix was out. [1]

F5 has now released updates. Staff who cannot install them at once can add a blocking rule that F5's support team provides. [1]

Boxes that only accept logins checked by another service are not affected, F5 says. [1]

F5 told customers to look for a pattern in their logs: several failed logins, then odd commands, then the box's traffic program crashing. [1]

On the same day, CISA, the US government's cyber-defence agency, put the flaw on its list of holes known to be in use. [1]

CISA gave US federal agencies until Friday to fix it. [1]

Shadowserver, a non-profit that scans the internet, counts more than 14,700 internet addresses that look like this F5 product. [1]

It cannot tell how many of those are already fixed, or are decoys set up to watch attackers. [1]

F5 said in October 2025 that state-backed hackers had broken into its own systems in August 2025 and stolen BIG-IP code and details of unfixed flaws. [1]

Why it matters. Watch whether F5 or CISA says who is behind these attacks, and whether Shadowserver's count of exposed boxes falls after Friday's deadline. [1]

CISA, the US cyber-defence agency, said on Wednesday that ransomware gangs are now using a flaw in TeamCity. [2] TeamCity is software that developers use to build, test and ship their code, and its maker JetBrains says more than 30,000 teams use it. [2] JetBrains fixed the flaw on 25 July. It lets a stranger skip the login and run commands on the server. [2] CISA first listed it as used in attacks on 5 August. [2] Shadowserver now counts just over 160 unfixed servers, down from about 700. [2]

Why it matters. A build server holds stored passwords and the code a company sends to its customers, so a gang inside it can reach much further. [2] The owners of the last 160 servers have had the fix for two months.

Breandan Knowlton-Hung, the UK civil service's deputy security chief, spoke at a London conference on 23 September. [4] He said a 2025 review by the National Audit Office, which checks UK government spending, found no proper plan behind the 2022 cyber strategy. [4] It also found one in three cyber jobs empty or filled by temporary contractors. [4] The UK government then built a service that scans thousands of public bodies for weaknesses anyone online can see, and tells the right team. [4] He said the median time to fix those weaknesses fell from about 50 days to 8. [4]

Why it matters. The UK government is about 465 separate bodies, each with its own budget and computers. [4] Those bodies fixed things faster when someone else did the finding, and he said nobody ordered those fixes. [4]

New Zealand's National Cyber Security Centre, part of the country's intelligence services, published its yearly threat report on Thursday. [3] It said China is the most persistent and capable government hacking in New Zealand, and also named Russia, Iran and North Korea. [3] Of 369 incidents that might matter to the whole country, in the year to June 2026, 86 had suspected links to government-backed groups. [3] Targets included government agencies, health and education bodies, and firms that run other companies' computers. [3] China's government has routinely denied such claims. [3]

Why it matters. Firms that run other companies' computers were among the targets, and one break-in there can reach every customer they serve. The agency says these spies often set up their access months or years before they use it. [3]

Josh Gottheimer, a Democrat in the US House of Representatives, has introduced the AI Cyber Defense Act with two Republican and two Democratic co-sponsors. [5] It would set up a CISA test programme giving operators of vital services, such as water plants, free use of advanced AI to find and fix holes. [5] It would allow $100 million from 2027 to 2031, but the US Congress would still have to hand over the money. [5] Small, rural, public and non-profit operators would go first. [5] This summer, groups with suspected links to Iran broke into 12 US water facilities. [6]

Why it matters. Gottheimer said many local communities cannot pay for the AI tools that find holes before attackers do. [5] A separate White House test in Texas relies on companies offering help for free, with no real budget behind it. [5]