# Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

> **Newsylist Open Intelligence Dossier** · First detected: 2026-09-09 06:29 UTC · Category: Technology · Sources: 7 · Current Velocity: 4.63

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| Security Affairs | PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMi4wFBVV95cUxPTWNSNVdseDJLVFFLclJ3V1hHLVFfWHE0VUFCQXZoN0c0WDY3UEZfNTNwdG1nc0gtLTgzSlV4aXVxM0FuYndGV0VsSTlHVFBoelRvczJ6STJhMzFuM3VkTG5zMGwtZm1JaEdUeTdMZk5sTmt2MjRUTUFsYWNfMjFaLXJqRjNyenBTeUNvaEpIcWh0QUE0YkZUbHlQWGdUWUZMMEpyRWFuZ0UxeGpNbXRRbzRscTVPM285aG9ORkFXOHVXbm5KT1ZLRkF2RFRETXBreXFrcXd5RjFyNHBLeTBQNVVIUdIB6AFBVV95cUxNcF9LTUJwSmh3NnJMVld6UGpVQW43U3NjbzhSdE9iRE9uQVUxUkp0WENjajk2YjZoWVdYbHVVN2h6RndLY1oxUjFCckk4MzktQW9RN2NlMWRKcU5aYUh6R3F0SGp0bHZ0WlFKcjhsSnh) |
| thehackernews.com | F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxOSXEwTUtNcTJTdDRpbzVEdDdPbGtFM1NJRW9NRUZkYXNRYll3ZGFZLVlyX3E1MnVfbWxYX205WkFqalR1ZlNzRGFLOFMtMndNZ0dueDdUSFdudGRLMjJaUmMwUmI2NmNiYTVLSmhFbWlfYjVLUHNCNkhEV1dLLVgzUV9B?oc=5) |
| kobaran.com | PoisonedRefresh Malware Hides Inside Apache Memory While F5 BIG-IP Files Stay Clean | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxNeGt4YldwNnYwdTI0Nk1jUDU1dFVjaThCVmo2MTkxQkZ3RGlzYnowSzFVZmVjZDVjZzA2N1NBaG9yd3BYTUhzQ2J4cGl3OUx3bUZXdC1CTnFPYXFjTmZCUjNDN0djTERYNmwtVmItS0hDZ01wSlB2RWRNTmtTMl9iMUc3cDBCS004aFVKV1RqYURGdjZrZDFqVEJadGFnUV9nNFlTR3kydnVqZnhM?oc=5) |
| CyberSecurityNews | Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMiV0FVX3lxTE5yX3JyanZjZW9PRTZZTUxpRTE3VXl1blZpb1B5ZDNBN0htb0VyUkYzWWZmWUJYQkJFQXZ2THh3a0FUWHoxd0c1dHlMekk2YjdiVTVzV1V4a9IBXEFVX3lxTE5YZ254clhHeEI0dTNxOFYxY0hqZGl1djVJZ3pBdUZIMWZRbV9PelAyNzJkb1l1N3pJb3FBdlhNTkN0cHhWSHpvNlV3Q3lHRnlzSW9FSUlHU2ROWDB3?oc=5) |
| gbhackers.com | PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMiWkFVX3lxTFBDQkZCdTk2WDBscUotMFBLLUZPWE1zcFRPV3RGand6di12SGNtSU1vU2NTQ1VyMWpWUENGMWwyYUpfanFqQzZjRERIcUJkeFZqN1BBUjdUcW53UdIBX0FVX3lxTE12dE5xNksycndaU19Cbml6LVBNeHVSSVZEVHZZTVJ6d2RZSU9QRThNU25NVXRxb21kQ20wTnBiWl9YMkZFUVhlUmZmYTAwNVY5QzZqZmI5QTd5ZzJ1R3VR?oc=5) |
| Sophos | Dissecting a PHP web server rootkit | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMieEFVX3lxTE9JRzJQV0VaMFFxZ3c5a1RPSVF6Mm5IVlJqem5LM0J0MEpHdXc4a2FnLVRWcEZTQ21lQXJWTDNtN3E5Tm9WeHJFMWI1TFFmVUZlbzZoOG5UYS1ucjB0UjVWUVFKUVhxcWpJU1UxMEx5T3ZNTXlWZnVvbQ?oc=5) |
| BleepingComputer | Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit | 2026-09-08 20:08 | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxQNlRRZVJTZWNxNFZjdDNpV3lfNEFZUlJ2UmlQbG9EUlp0YlUtN2JuXzhrb3ZEMXlXMjBYV1FyT0Y5b1MxMTFrSlVyS3gyVHdLNTdVZkFkeUVvaTRicnlIc0tWbHlKNXBMQTRkS1pDbEdscUd5allOS2VrQkI1ODduTWRpYUgtc1ZmdmY4cHBqYWdYTDNWUWtDVjlYZmR1WHMzYnJlRVFuVDQtV3di0gGyAUFVX3lxTE9QRGQ0a2FfMFNCR0RVZ3lEU1BZSGVyenRHd2FYcWVhREhfREQtOFB5WWF0NExQMktYTE4zZi1UMUJaZVdPNmNqeDJMdHJLb243U0xZYzJSQWhxYWY3a1h3Qk9DYlRwdHYzTjlqeF9DYktfekI0RUc4Q2xzSmtUdXlFWXV6aTlpREJXNXNMWUJtRTduSXZacjlPS0FDdF9KMGF6aWdCOTl) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-09-09/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*