Security researchers have detailed a sophisticated malware threat targeting F5 BIG-IP’s Access Policy Manager (APM) appliances that stealthily injects a PHP web shell into memory rather than writing it to disk — a tactic that renders traditional file-based detection largely ineffective. The findings arise from an analysis by Sophos, published September 7, 2026. The malware links to existing vulnerabilities and takes advantage of how certain PHP scripts are handled in memory, enabling attackers to hide their activity even during routine security scans.
How the Memory-Only Web Shell Works
Unlike typical web shells that reside in server folders and persist as files, this one appears only in memory. When Apache loads one of three specific PHP scripts (apm_css.php3, full_wt.php3, webtop_popup_css.php3) belonging to the BIG-IP APM webtop, the malware modifies the in-memory version of the script. The unaltered files on disk remain clean, so file integrity checks show no sign of compromise. These three scripts were previously flagged by F5 as part of indicator lists, though the presence of the files alone was not sufficient evidence of a breach. Sophos’ analysis clarifies how attackers bypass file checks by injecting malicious logic only as the PHP module loads into memory.
Vulnerability and Exploitation Details
The campaign is closely tied to CVE-2025-53521, initially disclosed in October 2025 as a denial-of-service issue, but reclassified in March 2026 as allowing remote code execution without authentication. Its severity scores are among the highest under both CVSS 3.1 (9.8) and CVSS 4.0 (9.3). F5 has published the list of affected versions and released fixes in newer firmware — notably 17.5.1.3, 17.1.3, 16.1.6.1, and 15.1.10.8 correspond to patched versions for their respective major releases.
Infection Chain & Persistence Mechanisms
The web shell comes at the end of a longer exploit chain. A malicious installer named “umount” infects the Apache binary (/usr/sbin/httpd) by pre-pending payload code, effectively hijacking execution before Apache’s own code runs. This installer also disables SELinux and infects critical startup scripts and binaries — actions likely designed to survive firmware upgrades and spread through installation media. Once Apache loads PHP, the malware identifies the libphp module in memory via /proc/self/maps, temporarily alters memory page permissions, tweaks function call targets related to file operations, then restores permissions — all to ensure that when one of the three referenced PHP scripts is loaded, the malicious shell is injected in real time.
The injected web shell listens for specially marked HTTP requests, decrypts payloads hidden within them, executes the code, and sends responses with HTTP status 201, masquerading as a stylesheet (CSS) response. Additionally, the malware creates a local socket at /run/bigtlog.pipe which, when accessed with a secret token, provides bash shell access — although there’s no evidence so far indicating whether the attacker uses that channel or if it integrates with the web-shell mechanism.
Detection and Remediation Guidance
Administrators should not rely solely on file scanning. Rather, checking behavior and memory is essential. Key indicators include unexpected presence of /run/bigtlog.pipe or /run/bigstart.ltm, discrepancies in hashes or timestamps of /usr/bin/umount or /usr/sbin/httpd, sys-eicheck failures tied to those binaries, or logs showing iControl REST API activity from localhost, disabling of SELinux, or unusual base64-encoded payloads. HTTP traffic with status 201 and CSS headers from the appliance is also suspicious.
Patching is critical. The fixes issued in October 2025 and later remain the primary defense. However, installing a patch does not guarantee removal of malware if the system was compromised prior to updating. National cybersecurity authorities advise conducting incident response actions: running F5’s built-in integrity checks, generating diagnostic reports, comparing in-memory modules with disk versions, and in cases where a thorough investigation isn’t feasible, isolating or rebuilding the appliance from clean sources to ensure full eradication.
Although the patch for CVE-2025-53521 was released nearly a year ago, there’s no definitive information confirming when exploitation started, how many systems are compromised, or who’s behind the attacks. Both Sophos and ESET, which have analyzed related samples and dubbed some of the activity “PoisonedRefresh,” report that attribution remains unknown.
It’s a reminder that cyber risk doesn’t end at patching. Even when you apply the latest updates, intruders who slipped in earlier can remain deeply embedded — invisibly rewriting memory, subverting monitoring, and escaping detection. Organizations using BIG-IP APM need to make memory integrity, unusual process behavior, and post-patch audits front-and-center in their defense strategy. What to watch for next: more malware from the same family, possible attribution breakthroughs, and tools aimed at detecting in-memory web shells across common enterprise infrastructures such as Apache and PHP.
