Published 1 day ago • loading... • Updated 1 day ago
Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers
Summary
A stealthy Linux rootkit is giving attackers a new way to keep control of compromised F5 BIG-IP Access Policy Manager servers. Instead of leaving an obvious malicious PHP file behind, it places a web shell only in the memory used by the running server process. The activity is linked to BIG-IP APM webtop environments running Apache and PHP. F5 has associated related activity with CVE-2025-53521, an exploited, unauthenticated remote-code-execution…
This story is only covered by news sources that have yet to be evaluated by the independent media monitoring agencies we use to assess the quality and reliability of news outlets on our platform. Learn more here.