{"uuid": "cbf5ea63-75e3-4622-b638-53c334544acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53521", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3042", "content": "\ud83d\udd34 PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells\n\nThe activity has been associated with exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw affecting BIG-IP APM when an access policy is configured on a virtual server.\n\nF5 has confirmed exploitation of the vulnerability and links the related compromise activity to the c05d5254 campaign.\n\nTraditional web shells are normally small PHP, JSP, or ASP scripts dropped into a web-accessible directory.", "creation_timestamp": "2026-09-10T00:00:12.566511Z"}