https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html
Revenue before quality again.
7 replies (most recent on top)
@nc again Joe? really
Still a lot of ex-employees here that just can’t let it go. Why does F5’s eventual demise you seek mean so much to you? Seriously, what do you think F5 or any company owes you? Nothing. They own you nothing. So grow up. If you get knocked down, get back up again is the saying. It’s not if you get knocked down, even if you get up again, complain and bi--h about it because that will make you a better person. This board is a sad testament to how people have grown to think everything is a right. You have no right to be employed anywhere. Maybe become more grateful and see how that influences how you move through the rest of your life. You can be angry all the time about what you didn’t get, or you can be grateful for what you did.
@hw maybe they should scan for simple vulnerabilities but that wouldn't be near as cool as complex. it's all in the word smithing.
@hw I'm going with incompetence. During my many years at F5 before being RIFd i found way to many critical errors of which most were ignored.
@OP Actually I am confused.
F5 published a blog post (https://www.f5.com/company/blog/securing-our-code-with-frontier-ai-what-f5-built-and-learned) stating they deployed frontier AI models to scan for complex code vulnerabilities in September 2025.The Reality: As exposed by watchTowr Labs (https://labs.watchtowr.com/is-this-a-joke-in-the-auth-header-f5-big-ip-unauth-heap-overflow-to-rce-cve-2026-94127/), CVE-2026-94127 is a remarkably basic, textbook flaw present in the code since March 2023 (BIG-IP 17.1.0).
Did F5 actually deliver on its security claims? It is difficult to comprehend how an AI-driven scanning tool could overlook such a fundamental flaw. If F5 was aware of this vulnerability and deliberately chose to conceal it, their motivations must be questioned. Was the tool configured or utilized incorrectly, or are we looking at a mix of operational incompetence and a deliberate cover-up? Regardless of the cause, the true concern is how many more "undiscovered" vulnerabilities remain hidden in the system.
switch the customers to that shape volterra instead. make them happy.
@OP Security "promises" look good on PowerPoint slides. Slide decks love phrases like "zero trust," "100% secure," and "unbreakable encryption." But as anyone in the trenches knows, there is often a massive gulf between a PowerPoint presentation and actual production reality.