42
55
F5 speeds up virtual patching to counter AI-driven threats
F5 added anomaly detection and agentic threat intelligence to its AI-powered WAF, enabling virtual patch enforcement against exploits within minutes.
F5 announced enhancements to F5 WAF for Distributed Cloud, adding anomaly detection that builds per-application traffic baselines and agentic threat intelligence built on technology from the Fletch acquisition. The AI-powered WAF scores each request in real time with a neural network risk engine, and internal testing claims 98% threat detection efficacy with false positives reduced to 1%. Automated virtual patching via Distributed Cloud Web App Scanning extends to F5 WAF for BIG-IP, letting teams block actively exploited vulnerabilities at the request level in minutes; agentic features are rolling out over coming months.
30
30
45
60
30
60
F5 enhances AI Gateway to control AI costs, access, and security
F5 integrated AI Gateway into its AI Security Platform, adding model routing, MCP governance, and guardrails, claiming up to 60% token spend reduction.
F5 announced AI Gateway enhancements combining a Model Gateway for cost optimization, an MCP Gateway for agent-to-tool access control, and AI Guardrails for prompt and response inspection. The company cited its 2026 State of Application Strategy Report finding 77% of organizations now treat inference as their dominant AI activity and manage an average of seven AI models. F5 claims smart routing, semantic caching, and GPU-aware load balancing can cut token spend by up to 60% without application changes. The gateway enforces budgets, model routing policies, and agent access controls centrally across SaaS, hybrid SaaS, and hybrid multicloud deployments, with air-gapped support planned.
30
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
Sophos's September 7 analysis describes malware tied to F5's c05d5254 activity that hooks apr_dso_load, modifies the libphp PHP module in memory, and injects a PHP web shell when Apache loads apm_css.php3, full_wt.php3 or webtop_popup_css.php3, leaving on-disk files clean. A separate installer infects /usr/sbin/httpd and umount, runs before Apache starts, disables SELinux (per ESET's related PoisonedRefresh analysis), and opens a local socket at /run/bigtlog.pipe for shell access. The activity is linked to CVE-2025-53521 in BIG-IP APM, rated 9.8 CVSS 3.1, patched in October 2025, added to CISA KEV on March 27, 2026.
72
60
30
55
55
42
55
30
30
60
60
42
60
55
30
60
60
30
30
30
60
30
30
60
60
55
55
60
30
F5 Bot Defense uses real-time risk scoring to detect fraud and abuse
F5 enhances Distributed Cloud Bot Defense with persistent device identification, real-time risk scoring, and agent-aware policies to manage AI agent traffic.
F5 announced enhancements to Distributed Cloud Bot Defense adding persistent device identification, real-time device risk scoring, risk-based workflow enforcement, and an agent-aware policy framework integrated with the F5 Application Delivery and Security Platform. The features aim to expose multi-account abuse, credential stuffing, and account takeover while allowing trusted AI agents to transact at machine speed. It targets fraud and abuse detection as agentic AI becomes a key interaction channel for sites, apps, and APIs.
22
60