[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsBNEys8v3SOzc4xYNQCE9aEqjvtOOaz9a660Max3e6I":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"7defafdd-15c3-4741-a95a-8e87cc09b8c3","F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans","f5-big-ip-apm-malware-injects-a-php-web-shell-into-memory-evading-disk-scans-88a031","Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean. Those three scripts are","A new malware variant targeting F5 BIG-IP Access Policy Manager appliances injects a PHP web shell directly into memory, bypassing traditional file-based detection methods. This technique, analyzed by Sophos, leverages a vulnerability (CVE-2025-53521) that allows for remote code execution, enabling attackers to gain control without leaving traces on the disk. The malware also infects system files like 'umount' and 'httpd' to ensure persistence and potential spread.","Malware injects PHP web shell into memory on F5 BIG-IP APM, evading disk-based detection.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ff5-big-ip-apm-malware-injects-php-web.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjIA552mINL2oyFm7mf9nHTwjJGJUVAtfYnMXbqYsowSEsDMzVsAgHG8MHKn5_EmwZ9bgRmhEndE20FhQAN4rvOLv5ESSAu0kHTV4QyygvUePYCJ1fvda0bU0Mzi5B9J8LHhULDeRRI9HGC84dntx8jaLu6WFLOz6OOhEwKNnSf6zzFRyAtlLKDQzHvygg\u002Fs1600\u002Ff5-malware.jpg","2026-09-09T07:36:49+00:00","2026-09-09T10:00:16.067412+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"BIG-IP APM","product",{"name":21,"type":22},"F5","vendor",{"name":24,"type":19},"Apache",{"name":26,"type":27},"PHP","technology",{"name":29,"type":19},"Apache Portable Runtime","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2025-53521","Vulnerability exploited by the malware for remote code execution.",{"type":34,"value":59,"context":60},"c05d5254","F5's internal tracking name for the malware.",{"type":34,"value":62,"context":63},"PoisonedRefresh","ESET's name for related malware samples.",[21,18,24],{"controls":66,"vendors":154},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":126,"name":127,"problem":128,"products":129},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[155,160],{"slug":156,"name":21,"logo_path":157,"roles":158},"f5","\u002Fvendor-logos\u002Ff5.png",[159],"affected",{"slug":161,"name":162,"logo_path":163,"roles":164},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[165],"reported_by",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":185},"f5-big-ip-memory-injected-web-shell-evades-disk-based-detection","F5 BIG-IP Memory-Injected Web Shell Evades Disk-Based Detection","Attackers are exploiting CVE-2025-53521 in F5 BIG-IP APM appliances to inject a PHP web shell directly into memory, completely bypassing traditional file-based antivirus and disk-scanning defenses. By also infecting system binaries like 'umount' and 'httpd', the malware establishes persistence and can spread laterally while remaining largely invisible to conventional security tools. This attack highlights a critical gap: organizations that rely solely on disk-based detection are blind to fileless and memory-resident threats. The compromise of a network access policy manager is especially severe, as these appliances sit at the perimeter and control authenticated access to internal resources.",[171,172,173,174,175,176,177,178,179,180,181,182,183,184],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","NIST AU-6: Audit Record Review, Analysis, and Reporting","ITIL: Change and Release Management (Emergency Change Procedures)","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1505.003: Server Software Component – Web Shell","MITRE ATT&CK T1601: Modify System Image",{}]