F5 BIG-IP APM PoisonedRefresh: Fileless PHP Web Shell After CVE-2025-53521 — Patch ≠ Clean

Here’s the sentence that should stick: patching is not cleaning. Sophos detailed a fileless PHP web shell on compromised F5 BIG-IP APM boxes that can leave the on-disk scripts looking pristine — so a happy file-integrity scan can still be wrong.

If your APM was ever exposed to CVE-2025-53521, assume you need a compromise assessment, not just a green patch ticket.

What happened

SophosLabs (analysis published around Sep 7–8, 2026) described a Linux implant on compromised F5 BIG-IP Access Policy Manager (APM) appliances that injects a PHP web shell into memory without changing the scripts on disk. ESET previously called related samples PoisonedRefresh; Sophos tracks the family as Linux/Agnt-IC.

F5 ties related activity to appliances hit by CVE-2025-53521 — an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server. (Originally disclosed as DoS in Oct 2025, later reclassified as critical RCE; in CISA KEV since March 2026.)

Why it matters

Fixing CVE-2025-53521 does not remove PoisonedRefresh. If the appliance was exploited before the patch, the shell can live in the running process — and possibly in httpd and upgrade media.

Tools that only hash the APM PHP scripts can report clean while the in-memory view still serves a web shell. That’s how these implants survive a “we patched” change window.

What to do first

• Confirm BIG-IP APM is on F5’s fixed trains for CVE-2025-53521.
• Run F5’s compromise-assessment guidance before calling the ticket done.
• Prioritize internet-exposed APM webtop / access-policy virtual servers.
• If compromise is plausible: rebuild from known-good media, rotate credentials and certs, and treat upgrade ISOs/images as untrusted until verified.
• Hunt the behavioral IoCs below — do not rely only on hashes of apm_css.php3 and friends.

Details

• Initial access CVE: CVE-2025-53521 (unauth RCE when APM access policy is on a virtual server)
• Malware: PoisonedRefresh (ESET) / Linux/Agnt-IC (Sophos)
• Target: F5 BIG-IP APM webtop PHP scripts in memory
• Key scripts: apm_css.php3, full_wt.php3, webtop_popup_css.php3
• Persistence angle: Installer observed as umount can infect /usr/sbin/httpd, disable SELinux, and poison upgrade images (umount, httpd, rc.local)

How it hides (short)

• Hooks __libc_start_main, intercepts APR apr_dso_load, finds libphp via /proc/self/maps, flips memory protections, rewrites open/size/mmap paths.
• When PHP maps the legitimate webtop scripts, the implant returns an in-memory view with a web shell prepended. Disk can stay untouched.

Hunt / verify

• Apache workers reading /proc/self/maps; permission flips around libphp.
• Presence of /run/bigtlog.pipe; Apache spawning /bin/bash.
• Unexpected POSTs to the three PHP3 scripts returning HTTP 201 with text/css.
• Do not clear the ticket on file hashes alone.

Sources

• Sophos: Dissecting a PHP web server rootkit
• The Hacker News: F5 BIG-IP APM malware injects PHP web shell into memory (Sep 9, 2026)
• Help Net Security: Linux rootkit on F5 BIG-IP APM (Sep 9, 2026)

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.