Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
Product
BIG-IP APM
- Mentions · 7d0
- Mentions · 30d0
- All mentions11
- First seenSep 9, 2026
- Last mentionedSep 27, 2026
Timeline
11 articles · newest firstF5 BIG-IP APM Zero-Day Exploited in Zero-Day RCE Attacks
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127 for unauthenticated remote code execution.
88
Someone's attacking a critical 0-day RCE in F5 BIG-IP APM
Attackers are exploiting critical F5 BIG-IP APM zero-day CVE-2026-94127; CISA added it to KEV.
87
CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
F5 patches critical CVSS 9.8 heap-based buffer overflow (CVE-2026-94127) in BIG-IP APM that allows unauthenticated RCE, now added to CISA KEV list.
90
Critical F5 BIG-IP APM Flaw Actively Exploited for Remote Code Execution
F5 says CVE-2026-94127, a critical unauthenticated BIG-IP APM RCE, is already exploited in the wild.
88
Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution
Attackers are exploiting F5 BIG-IP APM OAuth zero-day CVE-2026-94127 for unauthenticated remote code execution.
87
F5 security advisory (AV26-949)
Canada's Cyber Centre warns F5 BIG-IP APM flaw CVE-2026-94127 is being exploited in the wild.
82
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
80
2026-013: Critical Vulnerability in F5 BIG-IP APM
CERT-EU says exploited F5 BIG-IP APM flaw CVE-2026-94127 allows unauthenticated remote code execution.
86
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
78
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
72
Related CVEs
by mentions- CVE-2026-9412727%9.3Unauthenticated Heap-Overflow RCE in F5 BIG-IP APM with OAuth Profile
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
- CVE-2023-4674797%9.8F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE
- CVE-2026-939521%9.5Unauthenticated Input-Validation Flaw in VeloCloud Orchestrator (On-Prem)
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Appears with
- F5vendor · 11
- BIG-IPproduct · 6
- CISAorganization · 5
- F5organization · 3
- libphpproduct · 2
- Sophosvendor · 2
- PoisonedRefreshmalware · 2
- ESETvendor · 2
- Check Pointvendor · 2
- Apacheproduct · 2
- UK NCSCorganization · 1
- c05d5254threat actor · 1
- VeloCloud Orchestratorproduct · 1
- DarkMemalware · 1
- Mandiantorganization · 1
- Ireland NCSCorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.