F5 BIG-IP APM Malware Installs a PHP Web Shell Into Memory, Escaping Disk Scans #F5BIGIPAPM #Linux #LinuxRootKit

Hackers deployed a Linux rootkit on F5 BIG-IP APM devices, keeping a web shell in memory to evade file-based detection. The campaign is linked to CVE-2025-53521 and PoisonedRefresh. #F5BIGIPAPM #CVE202553521 #PoisonedRefresh