PoisonedRefresh Fileless Linux Rootkit Exploits Unauthenticated RCE in F5 BIG‑IP APM
What Happened – A new file‑less Linux rootkit, dubbed PoisonedRefresh, was discovered injecting PHP web shells directly into the memory of F5 BIG‑IP Access Policy Manager (APM) Apache processes. The rootkit is delivered via CVE‑2025‑53521, an unauthenticated remote‑code‑execution flaw in BIG‑IP APM when an access policy is configured on a virtual server.
Why It Matters for Trust & Control Assurance
- Demonstrates how a missing patch can bypass traditional file‑based detection, undermining the control objective of Vulnerability Management & Patch Assurance.
- Highlights the need for continuous, evidence‑driven verification that critical assets are running fully remediated firmware – a core requirement of a control‑assurance program.
- Aligns with Verisq’s Control Mapping capability, which helps organizations map remediation evidence to the VCF control “Maintain up‑to‑date vulnerability remediation processes” and generate audit‑ready artifacts.
Who Is Affected – Enterprises that deploy F5 BIG‑IP APM (network, cloud, and data‑center environments), spanning finance, healthcare, telecom, and other regulated sectors.
Recommended Actions
- Verify your BIG‑IP APM version against the F5 advisory and apply the patched release immediately.
- Conduct a post‑patch compromise assessment per F5 guidance to detect any lingering in‑memory shells.
- Integrate automated patch‑validation checks into your continuous control‑monitoring pipeline to produce defensible evidence for auditors.
Technical Notes
- Initial access: unauthenticated RCE via CVE‑2025‑53521.
- First‑stage payload hides in a modified
umountbinary, modifies SELinux, and embeds in upgrade images for persistence. - Second‑stage ELF binary injects itself before Apache’s
__libc_start_main, evading file‑system logs and many host‑based IDS. - No disk artifacts; detection relies on memory forensics or runtime integrity monitoring.
Source: Security Affairs