Linux Rootkit Allows Fileless PHP Web Shells on F5 BIG‑IP Devices

Researchers have uncovered a fresh Linux‑based rootkit that enables attackers to maintain foothold on compromised F5 BIG‑IP Access Policy Manager units while avoiding the creation of conventional files on the host.

The BIG‑IP family of appliances—especially the Access Policy Manager component—is extensively used to handle authentication, single sign‑on and traffic directing for enterprise networks and cloud environments. This pivotal function renders them appealing targets for threat actors aiming to lateral‑move or steal information.

In contrast to prior malware that drops a PHP web shell onto the web root, this rootkit injects the shell straight into the memory of the active web‑server process. Remaining solely in RAM, the payload leaves no file‑system footprints, making it harder for traditional antivirus and file‑integrity solutions to spot.

The security analysts who initially disclosed the method noted that the shell is capable of running arbitrary PHP code, granting remote operators the ability to run system commands, upload further payloads, or hop to additional machines. Since the malicious code vanishes when the process is restarted, adversaries typically pair it with persistence tricks that reload the rootkit after a reboot.

F5 Networks released an advisory urging its customers to install the newest security patches and to audit configurations for any unnecessary exposure of the APM interface. Specialists also suggest enforcing rigorous input validation, deploying host‑based intrusion detection, and watching process memory for irregular behavior.

The rise of fileless web shells signals a wider trend toward more covert attack techniques that bypass signature‑based defenses. Entities using F5 equipment should integrate behavioral analytics and perform routine penetration testing to detect concealed threats before they can be exploited for broader breaches.