30
42
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.
78
42
55
42
55
60
Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.
33
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
Sophos's September 7 analysis describes malware tied to F5's c05d5254 activity that hooks apr_dso_load, modifies the libphp PHP module in memory, and injects a PHP web shell when Apache loads apm_css.php3, full_wt.php3 or webtop_popup_css.php3, leaving on-disk files clean. A separate installer infects /usr/sbin/httpd and umount, runs before Apache starts, disables SELinux (per ESET's related PoisonedRefresh analysis), and opens a local socket at /run/bigtlog.pipe for shell access. The activity is linked to CVE-2025-53521 in BIG-IP APM, rated 9.8 CVSS 3.1, patched in October 2025, added to CISA KEV on March 27, 2026.
72
Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.
72
42
42
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
Sophos analyzed a Linux rootkit targeting F5 BIG-IP APM environments, also tracked by ESET as PoisonedRefresh, which hijacks Apache's apr_dso_load module loader to inject a fileless PHP web shell into memory. The implant intercepts __libc_start_main, hides strings with RC4, creates a password-protected local UNIX socket backdoor for interactive Bash access, and persists across BIG-IP upgrade images while modifying SELinux configuration. It is likely a second-stage payload following exploitation of CVE-2025-53521, a critical RCE flaw F5 reclassified from a DoS issue in March. The ShadowServer Foundation tracked 795 F5 BIG-IP APM endpoints exposed online.
76
42
42
42
60
42
60
42
42
30
30
42
Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory
Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.
Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.
78
42
55
47
30
42
30
Php Servers And Iot Devices Cyber
Infosecurity Magazine headline reports a cyber campaign targeting PHP servers and IoT devices; no further details available.
The Infosecurity Magazine headline indicates a cyber campaign against PHP servers and IoT devices. Article text was unavailable, so techniques, scale and attribution are unknown.
22
30
55
30
30
30
42
30