SecurityBleepingComputerabout 1 hour ago
F5 BIG-IP APM rootkit intercepts PHP, injects webshell
1 min read
A Linux rootkit on F5 BIG-IP APM devices intercepts PHP file loading and injects a fileless web shell into memory, avoiding disk writes. Sophos and ESET analyzed the malware, linked to CVE-2025-53521, which F5 reclassified from DoS to critical RCE in March.
Level
Hype check
Tap to vote and see what everyone thinks.
