{"uuid": "2d64743b-4232-4ab9-aa78-1b3ac2e2e760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53521", "type": "seen", "source": "https://t.me/pphm_HackerNews/3042", "content": "\ud83d\udd34 PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells\n\nThe activity has been associated with exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw affecting BIG-IP APM when an access policy is configured on a virtual server.\n\nF5 has confirmed exploitation of the vulnerability and links the related compromise activity to the c05d5254 campaign.\n\nTraditional web shells are normally small PHP, JSP, or ASP scripts dropped into a web-accessible directory.", "creation_timestamp": "2026-09-09T20:00:05.818187Z"}