F5 fixes exploited flaw in BIG-IP APM OAuth servers
F5 has released a security update after attackers exploited a serious bug in BIG-IP Access Policy Manager, allowing them to run code on affected systems without logging in. The vulnerability impacts only BIG-IP systems configured as OAuth authorization servers. The U.S. cybersecurity agency CISA added the flaw to its exploited vulnerabilities list and told federal agencies to apply F5's fix by September 25. F5 has not said which organizations were attacked or how many.
- Attackers exploited a buffer overflow in BIG-IP APM
- Only affects systems acting as OAuth authorization servers
- CISA set a federal fix deadline of September 25
- Number and targets of attacks not disclosed
- Limiting interface access does not mitigate this flaw
Sources covering this
More in Cybersecurity
Security startup Hacktron exploits vulnerability in OpenAI forum
Hacktron, an AI cybersecurity startup, found and exploited a security flaw in OpenAI's community forum that allowed access to an employee's internal account using Anthropic's Claude. The breach relied on an image processing vulnerability and was executed in less than 72 hours. Hacktron stopped short of accessing internal code and reported the issue to OpenAI, which then revoked affected tokens. Hacktron received a $6,500 bounty for the discovery.
Microsoft releases record number of security patches
Microsoft released updates to fix at least 974 security vulnerabilities across Windows and other products, its largest patch release to date. The update includes critical flaws, some already being exploited, and over 100 rated as dangers that could let attackers seize control of systems. The unprecedented volume is partly due to the use of AI for vulnerability detection, but experts warn that rapid growth complicates efforts to test and deploy fixes.
Microsoft releases record September patch for Windows
Microsoft issued its largest-ever security update for Windows, addressing over 960 vulnerabilities in its September release. More than 100 of these flaws are rated critical, and at least two are actively exploited. Several issues from previous updates, including failures in Microsoft Teams and Outlook on ARM devices, have been resolved. The volume of fixes is part of an industry-wide trend linked to increased use of AI for identifying software vulnerabilities.
Hackers claim FBI breach and theft of agent data
A hacking group known as ShinyHunters claims to have breached FBI systems and accessed personal data on thousands of FBI agents and job applicants, including names, home addresses, and phone numbers. Both TechCrunch and 404 Media reviewed samples provided by the hackers and confirmed that some details matched public records. The FBI jobs site and special agent applicant portal were down as of publication. The FBI declined to comment.