Sophos published a teardown of a Linux implant on F5 BIG-IP APM appliances that rewrites what Apache sees in memory rather than writing a web shell to disk — on a vulnerability whose federal remediation deadline came and went on March 30, 2026.
What happened
On Tuesday, September 8, 2026, Sophos published “Dissecting a PHP web server rootkit,” a technical teardown of a Linux implant found on F5 BIG-IP Access Policy Manager appliances. Sophos detects the sample as Linux/Agnt-IC. During the work, Sophos learned that ESET had analyzed the same malware independently and named it PoisonedRefresh. Help Net Security carried a summary on Wednesday, September 9. The initial access vector Sophos points to is CVE-2025-53521, the BIG-IP APM flaw CISA added to the Known Exploited Vulnerabilities catalog in March.
The mechanism is the story. Sophos describes the second stage this way: it “hides key operational strings with RC4, gains execution before the host application main() function is invoked by intercepting __libc_start_main, targets Apache’s PHP module by hooking the Apache Portable Runtime (APR) module loader (apr_dso_load), and injects a PHP web shell into memory.” The implant also hooks apr_time_now, and it intercepts mmap() so that when Apache maps three specific BIG-IP APM files — apm_css.php3, full_wt.php3, and webtop_popup_css.php3 — the process receives attacker PHP that is not present in the file on disk.
That is the part worth restating plainly. The files on the appliance do not change. Their hashes do not change. A file integrity check, a scheduled malware scan, or a support-account diff against a known-good image all come back clean, because the substitution happens between the kernel and the running process, not on the filesystem.
Sophos published artifacts. The second-stage sample is SHA-256 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9. String obfuscation uses RC4 with the hardcoded key TrswBWIl90Z5e38n. Alongside the HTTP path, the implant opens a local UNIX socket backdoor at /run/bigtlog.pipe gated by the token Kzwd6jM5. The injected web shell keys on the magic prefix BSOHAzPB with the key wSLjN1beuR, and answers with HTTP 201 and Content-Type: text/css; charset=utf-8 — a 201 on a stylesheet request is an odd enough pair to hunt for in proxy logs.
On attribution, Sophos is explicit: “While we do not have sufficient evidence to attribute this malware to a specific threat actor, the targeting and implementation suggest operational sophistication.” No actor name, no country, and this page does not supply one.
The underlying vulnerability has an awkward history. NVD shows CVE-2025-53521 published on October 15, 2025, with the description “When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE)” and CWE-121, a stack-based buffer overflow. That is not how the advisory started. Arctic Wolf, writing on March 31, 2026, records F5’s original October 2025 advisory as a medium-severity denial-of-service issue, revised on March 28, 2026 to a critical remote code execution flaw, with F5 stating the flaw was “being exploited by unauthenticated remote threat actors to deploy web shells.” F5’s own article, K000156741, did not render for us (see the sourcing note).
Why it matters
Three things about this record are worth separating out, because they push in different directions.
First, the scoring in NVD comes from one place. Both CVSS vectors on the record are attributed to [email protected] and both are marked Secondary: CVSS v4.0 at 9.3 with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, and CVSS v3.1 at 9.8. There is no primary NVD analysis score and no CISA-ADP enrichment on the record. Every number a scanner shows for this CVE traces to the vendor that first called it a denial of service. That is not an accusation — F5 revised the call itself, and the revised numbers are severe. It is a note about how thin the independent layer is on a vulnerability now confirmed to carry a rootkit.
Second, CISA’s own fields, as NVD republishes them, name the bug differently than NVD’s description does. cisaVulnerabilityName reads “F5 BIG-IP Stack-Based Buffer Overflow Vulnerability.” NVD’s description leads with remote code execution. Both are true — the overflow is the mechanism, the RCE is the consequence — but an operator searching a catalog for “RCE” and an operator searching for “buffer overflow” will not surface the same set of records, and this publication has now seen that split on Citrix NetScaler, where a denial-of-service label sat on a bug that yielded a root shell.
Third, the KEV entry carries a deadline that expired more than five months ago. cisaExploitAdd is 2026-03-27; cisaActionDue is 2026-03-30. That is a three-day clock, set months before BOD 26-04 made short clocks routine. The cisaRequiredAction field still reads: “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” BOD 22-01 was revoked by BOD 26-04 on June 10, 2026. NVD’s copy of this record was last modified on June 17, 2026, a week after the revocation, and still names the revoked directive. This is catalog-wide boilerplate rather than something specific to F5, but it is the text a federal operator reads when they look up what they are obliged to do, and it points at a directive that no longer exists.
Then there is the exposure count, where the public numbers do not line up. The ShadowServer Foundation runs a tracker for BIG-IP APM systems vulnerable to CVE-2025-53521, and as reported on September 8 it showed 795 endpoints exposed online the previous day. Coverage from March 2026, when the reclassification landed, put the figure at more than 14,000 BIG-IP APM devices exposed online. Those are different denominators — ShadowServer’s tracker counts systems it assesses as vulnerable, while the March figure counted APM devices reachable from the internet — so the drop is not cleanly a patching rate, and we are not going to present it as one. What both numbers agree on is that the remaining population is small enough to be enumerated, which is exactly the population an operator with a working memory-resident implant would want.
What to do
Patch, if you have not. Per the Cyber Security Agency of Singapore’s April 6, 2026 alert, the affected branches are BIG-IP APM 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2, and 17.5.0 through 17.5.1. Arctic Wolf gives the fixed builds as 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3. Confirm against K000156741 before you schedule the window.
Patching does not evict an implant that is already resident, so treat any internet-facing APM device that ran an affected build past March 2026 as needing a look, not just an upgrade. Hunt for requests to apm_css.php3, full_wt.php3, and webtop_popup_css.php3 that return HTTP 201, and for responses to those paths carrying Content-Type: text/css with a body that is not CSS. Check for /run/bigtlog.pipe. On the host, Sophos points at Apache processes reading /proc/self/maps and then changing memory permissions — an mprotect following a self-maps read is not normal for a web server.
Because the on-disk files are untouched, file-hash comparison will not answer the question. Memory acquisition, or at minimum inspecting the mapped regions of the running Apache processes, is what answers it. If an appliance cannot be examined that way, rebuilding from vendor media is the shorter path.
Federal operators should note that this CVE’s KEV deadline is long past rather than upcoming, and that the required-action text on the record refers to a revoked directive; the current obligation comes from BOD 26-04.
Sourcing note
Checked: Sophos’s “Dissecting a PHP web server rootkit” for the implant mechanics, indicators, and attribution language; the NVD record for CVE-2025-53521 for the description, CWE, both CVSS vectors and their sources, and CISA’s cisaExploitAdd, cisaActionDue, cisaVulnerabilityName, and cisaRequiredAction fields; the Cyber Security Agency of Singapore alert AL-2026-032 of April 6, 2026 for affected version ranges; Arctic Wolf’s March 31, 2026 write-up for the advisory revision timeline and fixed builds; and reporting by BleepingComputer on September 8 and Help Net Security on September 9 for the ShadowServer figure and the ESET naming.
Could not reach: F5’s advisory K000156741 rendered only a loading state to automated fetching, so F5’s exact current wording, its own revision history, and its fixed-version table are reported here secondhand through Arctic Wolf and CSA Singapore rather than quoted from the vendor. cisa.gov returns 403 to automated fetching, so the KEV dates here come from NIST’s republication of CISA’s fields in the NVD API rather than from the catalog page. ESET’s own PoisonedRefresh publication was not located; the name is reported through Sophos, which credits ESET.
Unresolved: the number of compromised appliances is not stated by Sophos or ESET, and no victim has been named. F5 has not, as far as we can find, published a statement about the rootkit specifically, as distinct from the March 2026 advisory revision. The relationship between ShadowServer’s 795 and the March figure of more than 14,000 is a difference in what is being counted, and neither source publishes a reconciliation. Attribution remains open, and Sophos says so.