Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG

Cybersecuritynews •Tushar Subhra Dutta • September 7, 2026

A stealthy Linux rootkit is giving attackers a new way to keep control of compromised F5 BIG-IP Access Policy Manager servers. Instead of leaving an obvious malicious PHP file behind, it places a web shell only in the memory used by the running server process. The activity is linked to BIG-IP APM webtop environments running […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Advanced PHP Web Shell Exploits F5 BIG-IP Systems A sophisticated Linux implant targeting F5 BIG-IP Access Policy Management (APM) environments has been identified, exploiting CVE-2025-53521, an unauthenticated remote code execution vulnerability. This malware, referred to as 'PoisonedRefresh,' employs advanced techniques like function hooking and memory-only web shell deployment to maintain persistent access. The attack specifically affects systems using Apache and PHP components, particularly in BIG-IP APM setups. Researchers have noted that the malware's installation process is designed to persist across system upgrades and modifications. The implant operates by injecting a PHP web shell into memory, avoiding detection by traditional file-based defenses. F5 has confirmed the exploitation of the vulnerability and provided guidance for remediation. Organizations using affected versions of BIG-IP APM are urged to follow F5's security recommendations to mitigate risks. 10 sources 75

Extracted Entities

Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)