Ethical Hacking News
F5 BIG-IP APM malware has been found to inject a PHP web shell into memory, evading traditional disk-based detection methods. This complex attack vector has left cybersecurity experts scrambling to find ways to mitigate the threat. To stay ahead of this evolving threat, it's essential to implement proactive security measures, including patching, monitoring, and continuous vigilance.
The PHP web shell has been discovered in F5 BIG-IP APM appliances, highlighting the need for vigilance against such threats.The malware hides the web shell in memory, evading traditional disk-based detection methods.The attack vector involves a separate installer that infects the Apache web server program and spreads the malware through installation media.The malware controls what PHP sees when it opens a script, and puts the web shell in front of the original content.Patching does not guarantee that an appliance was not compromised before the patch was applied.Experts advise isolating the appliance and rebuilding it as new, but this may cause an outage.
The recent discovery of a PHP web shell injected into memory by malware in F5 BIG-IP APM appliances has sent shockwaves through the cybersecurity community, highlighting the need for vigilance and proactive measures to protect against such threats. According to a recent analysis published by Sophos, the malware, linked to break-ins at F5 BIG-IP Access Policy Manager appliances, hides a PHP web shell in memory instead of in a file on disk, making it evasive of traditional disk-based detection methods.
The attack vector involves the use of a separate installer, found in a sample named umount, which infects the Apache web server program at /usr/sbin/httpd by adding malicious code to the front of the real file. The size of that added code matches the payload carried inside the installer, strongly suggesting that the installer puts it there. This installer is designed to be run as root, turning off SELinux and infecting umount, httpd, and rc.local inside BIG-IP install images, presumably to spread the malware to other systems through the installation media.
Once the Apache program loads the PHP module, libphp, the malware reads /proc/self/maps to find the module in memory, makes those memory pages writable, rewrites the calls the module uses to open, size, and map files, and then puts the original permissions back. From that point, it controls what PHP sees when it opens one of the three scripts. When the file is mapped into memory, the malware places the web shell in front of the original content.
The web shell reads the raw body of a request, checks it for a short marker, decrypts the rest, and runs it. It replies with HTTP status 201 and a CSS content type, so the exchange looks like a request for a stylesheet. The malware also opens a local socket at /run/bigtlog.pipe, connecting it to /bin/bash to give an interactive shell without opening a network port.
Experts are warning that patching does not settle whether an appliance was compromised before the patch went on. Ireland's NCSC said no timeline for exploitation is available, and that it expects some exploitation was or could have been happening before the flaw and its fix were first published in October 2025.
F5 has linked the c05d5254 activity to appliances affected by CVE-2025-53521, Sophos said. F5 first published that flaw on October 15, 2025, as a denial-of-service problem, and later reclassified it as remote code execution on March 27, 2026, and that it had been exploited. An attacker needs no login to use it, and F5 rates it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0.
If you have already patched, you may still be at risk. Sophos said its behavioral signals are leads to investigate, not proof on their own, and should be read alongside file, process, and memory evidence. F5's built-in sys-eicheck integrity check may fail due to the changes made to /usr/bin/umount and /usr/sbin/httpd. Comparing the contents of modules in memory against the copies on disk can provide additional insights.
The UK's NCSC advises isolating the appliance and rebuilding it as new, and says this may cause an outage. The situation highlights the need for continuous monitoring, patching, and proactive security measures to stay ahead of emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/F5-BIG-IP-APM-Malware-Injects-a-PHP-Web-Shell-Into-Memory-Evading-Disk-Scans-A-Growing-Concern-for-Cybersecurity-ehn.shtml
https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html
Published: Wed Sep 9 05:05:05 2026 by llama3.2 3B Q4_K_M
