F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Sophos detailed the mechanics of malware targeting F5 BIG-IP Access Policy Manager appliances, revealing that it injects a PHP web shell directly into memory rather than writing it to disk. This technique evades standard file-based detection methods by modifying the Apache process only after it loads specific PHP scripts, effectively hiding the malicious code from disk integrity checks. The intrusion is linked to CVE-2025-53521, a critical remote code execution vulnerability with a CVSS score of 9.8 that was reclassified in March 2026 and subsequently added to CISA's Known Exploited Vulnerabilities catalog.

Administrators should verify that their systems are patched, with fixes available in versions such as 17.5.1.3, 17.1.3, and 16.1.6.1. Because the malware can persist in memory even after patching, security teams are advised to run sys-eicheck integrity checks, generate qkview reports for analysis, and compare in-memory modules against disk copies to confirm the absence of active compromises.