Active intrusions are using CVE-2025-53521 against F5 BIG-IP APM appliances to install a Linux rootkit that keeps a PHP web shell in memory instead of on disk. BleepingComputer says the malware intercepts PHP file loading and injects the shell at runtime, so the appliance can be compromised without leaving the usual file artifacts.
That matters because the attacker’s code rides the PHP runtime, not a dropped file. Disk-based forensics and file-hash checks can look clean even while the BIG-IP access policy layer is still under attacker control.
For operators who use BIG-IP APM as the gatekeeper for virtual servers, the exposure is not just the appliance image but the control point itself. If the intrusion lives in memory, cleanup that only hunts for a bad file can miss the persistence layer entirely.
CVSS 9.8 CRITICAL: when a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code… EPSS 2% (82nd percentile).
CISA federal remediation date Mar 30 · date passed
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk.