F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware exploiting CVE-2025-53521 on F5 BIG-IP APM appliances injects a PHP web shell directly into memory, evading traditional disk-based detection. The malware modifies the Apache binary at /usr/sbin/httpd and hooks into the Apache Portable Runtime to intercept loading of PHP modules, dynamically injecting the web shell when specific PHP scripts are loaded. Attackers can gain remote code execution without authentication, and the malware establishes persistence through modified system binaries and hidden sockets, with indicators including unexpected file modifications, SELinux disablement, and anomalous HTTP responses.

AI-extracted · verify before operational use