Happy Birthday to leahcmd!

October 15th, 2025, F5 networks submitted SEC 8-K disclosing they had suffered a network compromise.

tl;dr some source code stolen, some customer data stolen, potentially impacts usa gov national security

F5 reports that they had detected a compromise through a suspected nation state Threat Actor on, or around, August 9th, 2025. Representatives from F5 reported that they believe the Threat Actors responsible for the compromise may have achieved access as far back as 12 months ago.

F5 reports they believe this unidentified Threat Actor gained, and maintained, persistent access to their production environments for their product BIG IP. Additionally, F5 believes this Threat Actor successfully exfiltrated proprietary source code for their product.

F5 states they do not believe any BIG IP and/or F5 vulnerabilities are being actively exploited. They do not believe any of their other products have been compromised (iHealth, CRM, etc). It was noted a small number of customers may have had information stolen. However, no details were provided on the number of customers impacted. Due to the size of F5, a "small" number could be 5 customers, or it could be 1,000 customers.

Due to the nature of compromise, and the potential impact to the United States national security (Item 1.05(c) of Form 8-K.), the United States Department of Justice allowed a delayed public disclosure for F5 products on September 12th, 2025.

Furthermore, the report discloses one of their Directors on the Board of Directors, has "stepped down". They are now acting as the Chief Technology Operations Officer reporting to F5's CEO to focus on and/or improve the companies security posture.

Correction has been made.

I initially wrote the compromise occurred in August. F5 detected* the compromise in August. The initial compromise (per F5) may have been as far back as 12 months ago.

Thank you to the commenter who noticed my poor choice of wording.

Mr. Beast, a well-established financial analyst with an emphasis on cryptocurrencies, has filed a trademark application for "MrBeast Financial".

Per the trademark application, MrBeast Financial will be a downloadable application for mobile devices which will aim to do the following:
- Banking services
- Short-term cash advances
- Cryptocurrency exchange services
- Investment bank services
- Investment management service
- Consumer lending services
- Insurance services
- Financial advisory services
- Consultancy services
- Financial planning services
- Financial education wellness services

This is excellent news as I have always personally wanted to take financial advice (especially regarding cryptocurrency) from a borderline sociopathic YouTube content creator.

I am so excited I am calling my bank this afternoon to liquidate my retirement 401k in totality and ensure him and his star-studded team of financial experts expertly invest in the latest shitcoins (I'm going to lose everything in a week)

> Insurance services

Took out a $200,000,000,000 life insurance policy from MrBeast. It costs me $800/month. It only pays out if I die in a plane crash as a result of a shark tornado.

Chat, my family and I are safe.

No, I'm not joking. He really is going into banking (or potentially planning on it)

https://www.businessinsider.com/youtube-star-mrbeast-taking-steps-to-launch-financial-services-2025-10

Currently the public vx-underground Discord (VX Feed) provides a near in-real-time update on when new material is synced to vx-underground.

Basically, you can see when new papers are pushed or malware samples (bulk collection) are synced.

However, I am open to suggestions on other ways to notify individuals of new content additions. Historically I have used Twitter and Telegram, but due to the size of content added (and terrible formatting) I think that these platforms kind of suck now for displaying the big ass list of stuff added.

Maybe I'll just throw it on here anyway and let it look like shit, I don't know.

I'm adding approx. 15 new papers a day and uploading roughly 7,000 malwares a day. Not too bad

Damn, I guess we're putting malware on the blockchain now

I don't know what the fuck a smart contract is, but I guess it can be abused, or something.

Thanks, North Korea

https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding

As is tradition, due to being auto immune compromised, I am sick. Weather and seasonal change is illegal and for nerds

Thank you everyone for notifying me about HuntressLabs stuff. I'll talk about that later.

Please accept this picture of a cat (its me rn fr)

HuntressLabs referenced VXUG in their CTF. They weren't compromised, or something. Everyone immediately assumed the worst LOL

I've seen a few people talk about crazy stories in cybersecurity. I'll share mine. I remember it so vividly it's like it happened yesterday.

This is a 100% real and true story.

I was hired on at a large AI company as the Master Chief Artificial Intelligence Engineer Scientist. However, unbeknownst to my colleagues, I was also a super cool and badass hacker (as you know).

One day the phone is ringing off the hook. I answer it. IT tells me there's been a cybersecurity attack in sector 79C.

Oh. My. God.

Sector 79C is where all top secret level code black data is stored. That's where Barack Obama's birth certificate is stored, the nuclear launch codes, and the corpse of Jimmy Hoffa. I was petrified.

I immediately ran full speed over to sector 79C. Although that sector is far away, I'm extremely fast and agile. I'm like a cool and badass ninja, or something. I used to coach Usain Bolt, no big deal.

Anyway, I kicked in the door. Sirens and alarms are blaring. The people in the room are screaming, running in circles, ripping their clothes off (they're on fire for some reason).

I told everyone to calm down. I'm arrived. I have come. I'm hot and ready.

I push the fat stupid loser Richard off his computer (he likes watching anime) and get to work. I see over 200 of our IP addresses have been hacked. I immediately write a JSON 0day botnet to fight back. Everyone is amazed at my skill.

BOOM! Kash Patel kicks in the door. I said, "Kash, what the hell is going on, Brotha?". He replied, "I'll see you in Hacker Valhalla.". Then he salutes me, throws me the American flag, and runs out the room. Even he was scared.

Back to business.

I check on my JSON botnet. It's winning. IP addresses have been whitelisted by Cloudflare and Google is pinging again. Close call.

I look at the IP addresses trying to hack us back. I was flabbergasted. It was Vladimir Putin himself. It was his home IP address. He made an amateur mistake and forget to use NordVPN before starting the cybersecurity IP address hack attack.

Within minutes the attack stopped and every started jumping for joy.

The fires that magically appeared had disappeared. People stopped running in the circles. Several smokin hot babes were so impressed they threw their bras at me. I was the man.

Afterward I went to the parking lot and hopped in my 2013 Lamborghini Veneno. Woman began chasing after me. I put on my cool hacker sunglasses, waved at them and said "toodles". I took off at 120MPH on my way to Bestbuy (I needed to update my antivirus).

Once I got home to my 47 bedroom and 14 bath mega mansion I decided to relax by taking a swim in my mote. I raced the alligators. I won again.

That's my hacker story (real and true)

Oh yeah, I forgot. That company I saved? Amazon.

Jeff Bezos thanked me personally and handed me a crisp $100,000,000 bill as a thank you.

Wow I feel like a fucking asshole.

Steve Bridges, the comedian, died. Not Mike Bridges. I'm so fucking deep fried today from being sick and everything else I fucked up his name despite looking directly at his wife's Instagram post.

Sigh. I'm sorry, Steve. I'm dumber than hell.