Year-long F5 hack exposes broad risks