MUST READ

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

 | 

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

 | 

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

 | 

Hackers Drain $320 Million From Liquid Network, Then Return Most of It

 | 

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

 | 

Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data

 | 

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

 | 

IT Help Desk Impersonation Lets Hackers Bypass MFA

 | 

Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak

 | 

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

 | 

Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day

 | 

JSCeal Hides Crypto Malware in V8 Bytecode

 | 

Why AI Agent Sandboxes Are Failing Security Tests

 | 

Berlin Ransomware Leak Exposes State Secrets

 | 

Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

 | 

AI Agents Hijacked German Wiki to Cheat, OpenAI Delayed Disclosure

 | 

Security Affairs newsletter Round 593 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

OpenAI Announced $1B in Defensive Tools for Water Utilities

 | 

PaperCut Flaws Exploited in Attacks on U.S. and European Schools

 | 

Broadcom Patches Critical VMware Workstation and Fusion VM-Escape Vulnerabilities

 | 

PoisonedRefresh

Pierluigi Paganini September 09, 2026
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts. SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET, they found in compromised F5 BIG-IP Access Policy Manager environments. Sophos tracks it as Linux/Agnt-IC. F5 has confirmed exploitation of the […]

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Malware / September 09, 2026

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Security / September 09, 2026

Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

Security / September 09, 2026

Hackers Drain $320 Million From Liquid Network, Then Return Most of It

Cyber Crime / September 08, 2026

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

Hacking / September 08, 2026