F5 BIG‑IP APM malware injects in‑memory PHP web shell, bypassing disk scans
Sophos analysis reveals that a new malware variant targets F5 BIG‑IP Access Policy Manager appliances by injecting a PHP web shell into the in‑memory copies of three native scripts, allowing the payload to run without ever touching the filesystem and evading traditional antivirus scans.
Sophos analysis shows that malware linked to recent break‑ins at F5 BIG‑IP Access Policy Manager (APM) appliances injects a PHP web shell directly into memory, allowing the shell to operate without ever being written to disk and thereby defeating conventional disk‑based scanning.
How the in‑memory injection works
The Hacker News reported that “Malware linked to break‑ins at F5 BIG‑IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7.” The report adds that the malware acts only when Apache loads any of three native PHP scripts – apm_css.php3, full_wt.php3 and webtop_popup_css.php3 – which are part of the BIG‑IP APM webtop.
When Apache loads one of these scripts, Sophos says the malware hooks the Apache Portable Runtime function apr_dso_load. It then reads /proc/self/maps to locate the loaded PHP module in memory, briefly makes the relevant memory pages writable, rewrites the calls the module uses to open, size and map files, and restores the original permissions. From that point the malware controls what PHP sees when it opens the script. “When the file is mapped into memory, the malware places the web shell in front of the original content,” the source explains.
Because the web shell exists only in the in‑memory copy, a traditional file‑system scan sees a clean script. “When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean,” the article notes. The shell does not need to exist in its final form on disk, meaning endpoint protection that relies on file‑based signatures is blind to this technique.
Timeline of the vulnerability and public disclosures
The underlying flaw, CVE‑2025‑53521, was first published by F5 on 15 October 2025 as a denial‑of‑service issue. F5 re‑classified the vulnerability as remote code execution on 27 March 2026 and confirmed that it was being exploited. Sophos released its detailed analysis on 7 September 2026, describing the in‑memory injection method. The Hacker News echoed the findings on 9 September 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2025‑53521 to its Known Exploited Vulnerabilities catalog on 14 September 2026, prompting organisations to reassess detection strategies.
Implications for operators and security teams
Customers running vulnerable BIG‑IP APM devices must understand that conventional disk‑based anti‑malware tools may no longer detect the presence of the web shell. Detection now requires memory‑analysis tools or behavioural monitoring that can flag unexpected modifications to Apache’s runtime environment. The fact that the malware only activates after the PHP module is loaded means that systems that do not host the affected scripts – for example, those that have disabled the APM webtop – are less likely to be impacted.
F5’s own guidance in March 2026 warned that changes to the three scripts alone do not prove a breach, but the new in‑memory technique shows that attackers can hide their activity even when the scripts appear untouched. Organisations should therefore verify that they have applied any patches released by F5 for CVE‑2025‑53521 and consider deploying host‑based intrusion detection that monitors the apr_dso_load function or the memory‑mapping behaviour of Apache.
F5 Networks at a glance
F5, Inc. (ticker FFIV) is a Seattle‑based technology company that designs application delivery and security solutions. The latest Form 10‑Q filed on 6 August 2026 covers the fiscal period 1 October 2025 to 30 June 2026. During that period the company reported revenue of $2,499,242,000, net income of $536,017,000, total assets of $6,829,074,000 and 56,826,000 shares outstanding. These figures provide context for the scale of the organisation whose products are now the focus of a sophisticated memory‑only attack.
| Metric | Value | Period end | Unit |
|---|---|---|---|
| Revenue | 2,499,242,000 | 2026‑06‑30 | USD |
| Net income | 536,017,000 | 2026‑06‑30 | USD |
| Total assets | 6,829,074,000 | 2026‑06‑30 | USD |
| Shares outstanding | 56,826,000 | 2026‑06‑30 | shares |
Source: SEC filing (Form 10‑Q) for fiscal year 2026, filed 6 August 2026.
What remains unknown
The Sophos sample examined was a single instance, so the prevalence of the in‑memory injection across the broader threat landscape is not yet quantified. Neither Sophos nor The Hacker News disclosed whether the web shell communicates with a command‑and‑control server, nor did they provide details on the payload’s capabilities beyond basic command execution. F5 has not publicly confirmed the exact mechanism, and the company’s chief executive and employee count were not available in the packet, so those details remain to be verified from the company’s own disclosures.
Security teams should monitor for updates from F5 and Sophos, apply any patches for CVE‑2025‑53521, and consider augmenting their detection stack with memory‑inspection tools to guard against this novel evasion technique.