PoisonedRefresh compromises F5 BIG-IP APM environments by injecting a PHP web shell into memory while leaving targeted PHP files unchanged on disk.
The implant uses runtime hooks, a local shell mechanism, and persistence components that complicate file-based detection.
Organizations should patch vulnerable BIG-IP APM deployments and investigate previously vulnerable appliances for compromise.
Hexnode XDR can extend investigation to managed endpoints, while Hexnode UEM supports administrator-device compliance.
Attackers targeting F5 BIG-IP APM environments have deployed a Linux rootkit that injects a PHP web shell directly into process memory. The technique leaves the targeted PHP files unchanged on disk, making conventional file-based web shell checks less effective.
Sophos analyzed the implant, while ESET independently tracks the malware as PoisonedRefresh. The malware appears to be a second-stage payload associated with compromised BIG-IP APM environments. Related activity is associated with CVE-2025-53521, an actively exploited BIG-IP APM remote code execution vulnerability. However, the available research does not establish CVE-2025-53521 as the initial-access vector for every analyzed PoisonedRefresh infection.
That distinction matters. CVE-2025-53521 can result in unauthenticated remote code execution, while PoisonedRefresh appears to be a second-stage payload likely deployed after exploitation. However, the available research does not establish CVE-2025-53521 as the deployment path for every PoisonedRefresh infection or document alternative initial-access vectors.
PoisonedRefresh by ESET; Linux/Agnt-IC detection by Sophos
Rootkit target
BIG-IP APM environments using Apache and PHP components
Distinctive behavior
In-memory PHP web shell injection
CISA KEV
Added March 27, 2026
Fixed releases for affected branches
15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3, and 21.0.0.
CVE-2025-53521 affects BIG-IP APM when an access policy is configured on a virtual server. F5 initially described the issue differently before later confirming that specific malicious traffic could result in unauthenticated RCE.
How PoisonedRefresh Makes Clean PHP Files Execute Malicious Code
The distinctive part of PoisonedRefresh is not simply that it provides a web shell. It changes what Apache’s PHP runtime sees when selected files are loaded.
Sophos found that the second-stage implant hooks __libc_start_main. It also hooks the Apache Portable Runtime function apr_dso_load to detect when Apache loads PHP components as part of its PHP-injection mechanism.
From there, the malware manipulates memory behavior inside libphp. This lets it alter the in-memory representation of selected BIG-IP APM webtop scripts, including:
apm_css.php3
full_wt.php3
webtop_popup_css.php3
The PHP files stored on disk can therefore remain unchanged while Apache workers process malicious content injected into memory.
Searching the filesystem specifically for a malicious .php web shell may miss this payload because the targeted PHP files remain unchanged while malicious content is injected into their in-memory representation.
Magic Requests Trigger the Hidden PHP Web Shell
The injected code waits for specially formatted HTTP requests.
When a matching request arrives, the web shell processes attacker-controlled data and executes the supplied PHP through eval. Responses can use HTTP 201 with a text/css content type, helping the command channel resemble traffic associated with the targeted webtop resources.
This behavior gives defenders network and application-layer indicators even when the malicious PHP itself cannot be found on disk.
PoisonedRefresh Adds a Local Shell Beyond the Web Backdoor
Sophos also identified another access mechanism at /run/bigtlog.pipe.
The implant creates this path as a local UNIX-domain socket. After its authentication condition is satisfied, it can redirect standard input, output, and error to /bin/bash, providing interactive shell access.
Unlike a conventional TCP listener, the socket is local to the compromised system. An attacker would therefore need another way to interact with it. Sophos had not identified that component in the analyzed evidence.
The distinction is important because the socket demonstrates an additional malware capability without proving how attackers accessed that capability during every intrusion.
The Rootkit Reaches Beyond a Memory-Only PHP Payload
Calling PoisonedRefresh purely “fileless” can also obscure part of the attack.
The PHP web shell is injected into memory, while Sophos found that a distinct installer or propagation component infected /usr/sbin/httpd, modified SELinux configurations, and established persistence across BIG-IP upgrade images.
F5 separately published compromise indicators in advisory K000160486. These broader F5 indicators should not automatically be attributed to PoisonedRefresh unless evidence links them to the same intrusion.
Therefore, defenders should combine runtime and memory investigation with checks for modified system files, SELinux configuration changes, and other persistence artifacts.
5 Ways Hexnode Strengthens Your Incident Response Plan
Learn how threat investigation, remediation actions, and UEM controls can strengthen enterprise incident response workflows.
What Should BIG-IP APM Administrators Investigate?
Organizations currently running vulnerable BIG-IP APM releases, or appliances that were upgraded after previously running a vulnerable release, should follow F5’s official remediation and compromise-assessment guidance.
Useful investigation leads from the available research include:
Apache workers reading /proc/self/maps
memory-protection changes involving libphp
creation of /run/bigtlog.pipe
/bin/bash launches associated with Apache or the suspected implant activity
unusual POST requests to the targeted .php3 endpoints
responses combining HTTP 201 with a text/css content type
These indicators should be correlated with other evidence rather than treated individually as definitive proof of compromise.
For appliances that ran vulnerable releases, applying the fix should be paired with compromise assessment. Government advisories recommend examining potentially affected systems, including appliances later upgraded from vulnerable releases, while distinguishing those systems from clean installations of fixed software.
Where Hexnode Fits After an Edge-Appliance Compromise
The F5 BIG-IP APM rootkit runs on the BIG-IP appliance itself, so endpoint security tools should not be presented as direct PoisonedRefresh detection or remediation mechanisms.
However, an edge-device compromise can justify expanding an investigation to administrator workstations and other managed endpoints when evidence indicates activity beyond the appliance.
Featured resource
Why XDR Is Stronger With UEM
See how combining endpoint management with extended detection and response can improve security visibility, investigation, and incident response.
Investigate Suspicious Endpoint Activity with Hexnode XDR
Hexnode XDR protects supported Windows and macOS endpoints; it does not install on or directly protect the Linux-based BIG-IP appliance discussed in this incident. If responders identify suspicious activity on managed Windows or macOS endpoints connected to the broader investigation, they can use Hexnode XDR’s threat-hunting and query-based investigation capabilities.
Security teams can use these capabilities to investigate endpoint activity and respond to confirmed endpoint threats. Current Hexnode XDR capabilities also include device isolation, process termination and file quarantine. These actions apply to supported endpoints, not the compromised BIG-IP appliance itself.
Therefore, Hexnode XDR complements the wider investigation but does not replace F5-specific appliance forensics or remediation.
Maintain Security Posture on Administrative Endpoints with Hexnode UEM
Hexnode UEM can support a separate defensive layer around workstations used by IT and security administrators.
Administrators can define compliance policies across managed platforms and identify devices that fail configured requirements. Hexnode UEM also supports remote custom-script execution on managed Windows, macOS, and Linux devices, subject to documented platform requirements.
These controls can help organizations maintain compliance and manage administrator endpoints during a broader incident. They do not patch CVE-2025-53521 or remove PoisonedRefresh from a BIG-IP appliance.
PoisonedRefresh Makes Runtime Integrity Part of BIG-IP Incident Response
The F5 BIG-IP APM rootkit demonstrates why checking PHP files alone cannot rule out a web shell.
PoisonedRefresh changes the runtime view of legitimate PHP content while leaving the corresponding PHP files on disk untouched.
A separate installer or propagation component infected /usr/sbin/httpd, while the second-stage implant creates an authentication-protected local UNIX-domain socket capable of launching an interactive Bash shell.
Organizations should apply F5’s fixes to vulnerable BIG-IP APM deployments and assess appliances that previously ran vulnerable releases for evidence of compromise.
Endpoint investigation can then extend beyond the appliance when incident evidence warrants it. Hexnode XDR can support investigation and containment on managed Windows and macOS endpoints, while Hexnode UEM can help administrators define compliance requirements and identify non-compliant administrator devices. Neither replaces BIG-IP-specific remediation.
Extend Threat Investigation to Your Endpoints
Investigate suspicious endpoint activity and respond to confirmed threats across managed Windows and macOS environments with Hexnode XDR.
I write at the intersection of technology, process, and people, focusing on explaining complex products with clarity. I break down tools, systems, and workflows without any noise, jargon, or the hype.
