PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory

Gbhackers •Mayura Kathir • September 7, 2026

Share: View original

A sophisticated Linux implant linked to compromised F5 BIG-IP Access Policy Management (APM) environments. The activity has been associated with exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw affecting BIG-IP APM when an access policy is configured on a virtual server. F5 has confirmed exploitation of the vulnerability and links the related compromise activity […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Advanced PHP Web Shell Exploits F5 BIG-IP Systems A sophisticated Linux implant targeting F5 BIG-IP Access Policy Management (APM) environments has been identified, exploiting CVE-2025-53521, an unauthenticated remote code execution vulnerability. This malware, referred to as 'PoisonedRefresh,' employs advanced techniques like function hooking and memory-only web shell deployment to maintain persistent access. The attack specifically affects systems using Apache and PHP components, particularly in BIG-IP APM setups. Researchers have noted that the malware's installation process is designed to persist across system upgrades and modifications. The implant operates by injecting a PHP web shell into memory, avoiding detection by traditional file-based defenses. F5 has confirmed the exploitation of the vulnerability and provided guidance for remediation. Organizations using affected versions of BIG-IP APM are urged to follow F5's security recommendations to mitigate risks. 12 sources 75

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

CWE-94 - Code Injection

Malware (1)

PoisonedRefresh

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Platforms (2)