Share on LinkedInShare on LinkedIn

ARTICLE · 21 SEPTEMBER 2026

Ankura CTIX FLASH Update – September 11, 2026

Treasury's proposed rule on payment stablecoins establishes critical territorial boundaries for U.S. issuance and foreign token operations. Organizations must understand certification requirements, compliance frameworks, and jurisdictional triggers before entering the regulated stablecoin market.

United StatesFinance and Banking

Malware Activity

Fileless Linux Rootkit Targets F5 BIG-IP APM Through In-Memory Web Shell Injection

A sophisticated Linux rootkit dubbed PoisonedRefresh is targeting F5 BIG-IP Access Policy Manager (APM) environments, using advanced Linux and Apache hooking techniques to inject a fileless PHP web shell directly into memory while leaving legitimate PHP files on disk untouched. Sophos assesses the malware as a likely second-stage payload deployed following exploitation of CVE-2025-53521, a critical remote code execution (RCE) vulnerability in F5 BIG-IP, with an unidentified installer or propagation component modifying the Apache /usr/sbin/httpd executable, altering SELinux configurations, and establishing persistence across BIG-IP upgrades. Once Apache starts, the rootkit intercepts __libc_start_main and the Apache Portable Runtime module loader to hook PHP operations, dynamically injecting its web shell into legitimate BIG-IP APM webtop scripts such as apm_css.php3, full_wt.php3,

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from