{"uuid": "9084769f-4a0b-42f1-b7a1-1ab698350a2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-53521", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3muzumq4hno25", "content": "Sophos found a rootkit on F5 BIG-IP APM appliances that injects a PHP web shell into Apache's memory, leaving disk files unchanged. It arrives via CVE-2025-53521, which F5 rated a denial of service in March and later reclassified as unauthenticated RCE. sophos.com/en-us/blog/di...", "creation_timestamp": "2026-09-08T20:33:24.550432Z"}