Sophos analysis (reported by BleepingComputer on 8 September 2026) describes malware on compromised F5 BIG-IP Access Policy Manager appliances that injects a PHP web shell into memory when Apache loads APM webtop scripts apm_css.php3, full_wt.php3 or webtop_popup_css.php3 — so on-disk file hashes can look clean.

F5 previously tracked related activity as malware family c05d5254 and warned those three scripts can be modified or hold in-memory-only shells (IoC list from March). Defenders must not rely on disk-only webshell scans; compare runtime/Apache memory and hunt the F5 IoCs.

Sophos says F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated remote code execution flaw. (source: Sophos) BleepingComputer (8 September 2026) adds that ESET tracks the malware as PoisonedRefresh; that its installer infects Apache's /usr/sbin/httpd binary, modifies SELinux and persists across BIG-IP upgrade images; that the second stage hides strings with RC4 and hooks __libc_start_main and apr_dso_load; that CVE-2025-53521 is a critical RCE flaw F5 reclassified from a denial-of-service issue in March; and that the Shadowserver Foundation reported 795 exposed endpoints the day before its report.

BleepingComputer lists hunting signals from Sophos: Apache workers reading /proc/self/maps, creating /run/bigtlog.pipe or launching /bin/bash, unusual POSTs to the targeted .php3 paths, and HTTP 201 responses served as text/css. (source: BleepingComputer)

Correction (27 Oct 2026): a second card on the same Sophos research (PoisonedRefresh, 8 September) has been merged into this one and removed. (source: BleepingComputer)

Correction (27 Oct 2026): the card date has moved from 7 to 8 September 2026, the date of BleepingComputer's report; Sophos's post shows no visible date. (source: BleepingComputer)

Correction (02 Nov 2026): removed The Hacker News as a source. (source: Sophos; BleepingComputer)