#ParsedReport #CompletenessLow
07-09-2026

Dissecting a PHP web server rootkit

https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit

Report completeness: Low

Threats:
Chinachopper

Victims:
Big ip access policy management, Apache php deployments

CVEs:
CVE-2025-53521 [Vulners]
CVSS V3.1: 9.8,
Vulners: Exploitation: True
Soft:
- f5 big-ip_access_policy_manager (<15.1.10.8, <16.1.6.1, <17.1.3, <17.5.1.3)


TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1014, T1027, T1027.009, T1059, T1059.004, T1106, T1140, T1190, T1505.003, T1564, have more...

IOCs:
Hash: 1
IP: 0
Domain: 0
Url: 0
Email: 0
BrowserExtension: 0

Soft:
Linux, BIG-IP, SELinux, NIX do, NIX so, UNIX, inux, s

Algorithms:
sha256, rc4

Functions:
main, mmap, wrapper, fork

Languages:
php

Platforms:
x86