Home Today’s Briefing Deep Dives In Play Trending For You Discover My Stack Saved Off Radar Search

Loading today’s stories

Today

AI-assisted reporting, grounded in a per-article claim ledger. Perspective Coverage and Reality Strip separate source viewpoints from evidence, adoption, hype, incentives, and confidence.

Today

Front Page
Today’s Briefing
Newsletters
Trending
For You
Discover
My Stack
Saved
Off Radar
Search

Sections

Security
Build
Invest
Product
Leadership
Science

Company

About
Mission
How this is made
Evidence Index
The desks
The sources we read
Corrections
Press and brand
The daily edition

Trending now

Data privacy
Vulnerability Disclosure
Circular AI Financing
Self-Hosted Software
Business Email Compromise
Cyber Insurance
Breach Disclosure
Phishing
Multi-Factor Authentication
Platform Regulation

How this is made

Today For You My Stack Off Radar Search

PoisonedRefresh — other — Clarity Today

other

PoisonedRefresh

ESET's name for a Linux web-server implant that hooks Apache module loading to serve a PHP web shell held only in process memory.

Current clusters

security1 publisher

Implant on CVE-2025-53521 BIG-IP APM boxes persists through F5 upgrade images

SophosLabs pulled apart a second-stage Linux payload that hooks Apache's module loader and keeps its PHP web shell in memory only, and the installer behind it writes itself into BIG-IP upgrade images, so a version bump does not evict it.

Publishers:nakedsecurity.sophos.com

Reality

Evidence72
Adoption40
Hype gap+10
Incentives58

Confidence65