PoisonedRefresh: Fileless Linux rootkit hides memory-resident PHP web shell on F5 BIG-IP APM devices exploited via CVE-2025-53521
Sophos analyzed a stealth Linux rootkit — tracked by Sophos as Linux/Agnt-IC and dubbed PoisonedRefresh by ESET — deployed on compromised F5 BIG-IP Access Policy Manager appliances after exploitation of CVE-2025-53521, an unauthenticated RCE. The implant…
On September 8, 2026, SophosLabs published an analysis of a second-stage Linux rootkit implant found in compromised F5 BIG-IP Access Policy Manager (APM) environments, which serve enterprise, financial, government, and public sector deployments. Initial access leveraged CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed active exploitation and linked the activity to cluster c05d5254, while Shadowserver observed 795 internet-exposed vulnerable endpoints at disclosure. A first-stage installer hidden in a modified umount binary modifies /usr/sbin/httpd, alters the SELinux configuration, and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and uses mmap manipulation to inject a PHP web shell into libphp memory, serving modified in-memory versions of the legitimate webtop files apm_css.php3, full_wt.php3, and webtop_popup_css.php3 while on-disk files remain unchanged, so hashes and file-integrity checks pass. The web shell reads php://input, decrypts RC4-encrypted commands, and replies with HTTP 201 text/css responses to blend in; it also creates an authenticated UNIX domain socket at /run/bigtlog.pipe that provides an interactive /bin/bash session without opening TCP ports. Because compromised APM appliances handle federated SSO and terminate TLS at enterprise perimeters, researchers warn of SSO token and credential theft and lateral movement to trusted downstream applications.
- CVE-2025-53521 is an unauthenticated RCE in F5 BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation in the wild and linked the activity to cluster c05d5254.
- Shadowserver observed 795 internet-exposed endpoints vulnerable to CVE-2025-53521 at the time of disclosure.
- SophosLabs published its analysis on 2026-09-08; the malware is tracked by Sophos as Linux/Agnt-IC and dubbed PoisonedRefresh by ESET.
- First stage hides in a modified umount binary, modifies /usr/sbin/httpd and the SELinux configuration, and embeds itself in BIG-IP upgrade images for persistence.
- Second stage intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts.
- The web shell serves modified in-memory versions of apm_css.php3, full_wt.php3, and webtop_popup_css.php3; on-disk files are unchanged, so hashes and file-integrity monitoring pass.
- The web shell reads php://input, decrypts RC4-encrypted commands, and replies with HTTP 201 text/css responses to blend in.
- An authenticated UNIX domain socket at /run/bigtlog.pipe provides an interactive /bin/bash session without opening TCP ports.
Coverage timelineoldest first · each row is one article
- · 7d agoPoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Security Affairs· 78
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE CVE-2025-53521 is a stack-based buffer overflow (CWE-121) in F5 BIG-IP's Access Policy Manager (APM) that allows remote code execution. The flaw is triggered when a virtual server is configured with an APM access policy and receives specific malicious network traffic; no authentication or user interaction is required per the CVSS 4.0 vector. An attacker who exploits it gains remote code execution on the BIG-IP device, and in observed intrusions attackers have deployed a fileless Linux rootkit (dubbed 'PoisonedRefresh') that injects a PHP web shell into server memory to evade disk-based scanning. Any F5 BIG-IP deployment with an APM access policy configured on a virtual server is potentially affected; versions that have reached End of Technical Support are not evaluated by the vendor. The vulnerability is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-27, with active exploitation and in-memory malware campaigns confirmed in press reports, though ransomware use is unknown. Do: Patch immediately by upgrading affected BIG-IP systems to fixed releases per F5's security advisory (note that versions in End of Technical Support will not be fixed and should be upgraded or retired), prioritizing internet-facing virtual servers with APM access policies. Because observed attacks deploy a memory-resident PHP web shell via the PoisonedRefresh Linux rootkit, disk-only scans may miss compromise — inspect running processes and memory, and hunt for suspicious PHP or rootkit activity on BIG-IP APM devices. Federal agencies must follow the required action in CISA KEV/BOD 22-01: apply vendor mitigations or discontinue use of the product if mitigations are unavailable. | 9.3 | 2% | KEV |
| large≈14,000+ internet-exposed F5 BIG-IP devices (per public scan figures cited in press coverage) |