F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Malware injects PHP web shell into memory on F5 BIG-IP APM, evading disk-based detection.
A new malware variant targeting F5 BIG-IP Access Policy Manager appliances injects a PHP web shell directly into memory, bypassing traditional file-based detection methods. This technique, analyzed by Sophos, leverages a vulnerability (CVE-2025-53521) that allows for remote code execution, enabling attackers to gain control without leaving traces on the disk. The malware also infects system files like 'umount' and 'httpd' to ensure persistence and potential spread.
AI summary of the linked source. Not reviewed by an editor. How this works
Run F5?
Get an email when a new story names F5, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are exploiting CVE-2025-53521 in F5 BIG-IP APM appliances to inject a PHP web shell directly into memory, completely bypassing traditional file-based antivirus and disk-scanning defenses. By also infecting system binaries like 'umount' and 'httpd', the malware establishes persistence and can spread laterally while remaining largely invisible to conventional security tools. This attack highlights a critical gap: organizations that rely solely on disk-based detection are blind to fileless and memory-resident threats. The compromise of a network access policy manager is especially severe, as these appliances sit at the perimeter and control authenticated access to internal resources.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-53521
- malware — c05d5254
- malware — PoisonedRefresh