Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
1
Stories per day · 30 days
1 RSS
8 stories, newest first · one card per story
Stories tagged #cve-2025-53521
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
Attackers Exploit RCE Flaw as 14,000 F5 BIG
2
U.S. CISA adds a flaw in F5 BIG-IP AMP to its Known Exploited Vulnerabilities catalog
1
NCSC Urges Immediate Patching of F5 BIG
1
Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521)
1
Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages
1
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG
1