c05d5254

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 9, 2026
Last mentionedSep 9, 2026

Timeline

1 articles · newest first

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.

Security AffairsSep 9, 08:50 UTC · Sep 9, 2026MalwareExploitedCVE-2025-535212 · 1 read

Related CVEs

by mentions

CVE-2025-535212%9.3
Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
published Oct 15, 2025F5 BIG-IP (BIG-IP Access Policy Manager / APM)KEV

Appears with

Sophosvendor · 1
libphpproduct · 1
ESETvendor · 1
Shadowserver Foundationorganization · 1
SophosLabsorganization · 1
PoisonedRefreshmalware · 1
F5vendor · 1
BIG-IP APMproduct · 1
Linux/Agnt-ICmalware · 1
Apacheproduct · 1

Entities are extracted by the model from each article. First seen Sep 9, 2026, last mentioned Sep 9, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.