F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Summary: Sophos reported on September 7 that malware tied to F5 BIG-IP APM compromises hides a PHP web shell in memory rather than on disk, injecting it when Apache loads apm_css.php3, full_wt.php3 or webtop_popup_css.php3, so file scans can come back clean. F5 has linked the activity to CVE-2025-53521, first published October 15, 2025 as a denial-of-service flaw and reclassified as remote code execution on March 27, 2026, rated 9.8 on CVSS 3.1 and added to CISA's Known Exploited Vulnerabilities catalog the same day with a March 30 deadline for federal civilian agencies.
Why it matters: The patch that fixes this is nearly a year old, and neither Sophos nor ESET can say whether upgrading removes malware already installed, with both describing a component built to survive upgrade images. The UK's NCSC advises investigating for compromise regardless of when the system was updated, and no one has named the attacker.
Read the original at The Hacker News ↗
- Mentions
- CVE-2025-53521
- Related
- CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 27, 2026