CVE-2025-53521 — a flaw F5 first published on October 15, 2025 and reclassified as remote code execution on March 27, 2026 — is at the center of a stealthy intrusion technique that leaves a PHP web shell in memory instead of on disk, Sophos said in an analysis published September 7.
How the malware hides a PHP web shell in memory
Sophos examined a single sample that, when Apache loads certain BIG‑IP APM PHP scripts, injects a web shell into the copy of the file that resides in memory. The three targeted scripts are apm_css.php3, full_wt.php3 and webtop_popup_css.php3 — the same files F5 listed in March as indicators that "do not show a break‑in" by themselves. Sophos quoted the technique succinctly: the web shell "does not need to exist in its final form on disk."
The injected web shell is placed in front of the original content when the file is mapped into memory. It reads the raw HTTP request body, looks for a short marker, decrypts the remainder, executes it, and responds with HTTP status 201 and a CSS content type so the exchange resembles a stylesheet request.
The infection chain: installer, Apache infection, and persistence
Sophos reported that the in‑memory web shell is the final stage of a longer chain. An installer binary, found in a sample named umount, appears to prepend malicious code to /usr/sbin/httpd — the Apache binary — with the added code size matching the payload carried inside the installer. Because the malicious code sits inside Apache, it runs before Apache's own code starts.
Sophos said the malware hooks an Apache Portable Runtime function, apr_dso_load, then waits until libphp (the PHP module) is loaded. It inspects /proc/self/maps to find libphp in memory, briefly makes those pages writable, rewrites calls the module uses to open, size, and map files, then restores permissions — effectively controlling what PHP sees when it opens the three .php3 scripts.
ESET, which analyzed related samples in April and named the family PoisonedRefresh, reported that the installer is intended to be run as root, turns off SELinux, and infects umount, httpd and rc.local inside BIG‑IP install images — a mechanism ESET said was presumably to spread the malware via installation media. Those descriptions, from Sophos and ESET, together describe both in‑memory stealth and components that touch disk and installation images.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSignals and indicators defenders can check
Sophos emphasized that behavioral signals are leads to investigate, not standalone proof, and F5 published a parallel list of indicators. The combined checks defenders should consider include:
- Presence of files: /run/bigtlog.pipe or /run/bigstart.ltm
- Binary anomalies: hash, size or timestamp mismatches on /usr/bin/umount or /usr/sbin/httpd versus known‑good copies (F5 notes sizes and timestamps vary across releases and hotfixes)
- Sys‑eicheck failing because one of those binaries changed
- Log entries: /var/log/restjavad-audit showing a local user reaching the iControl REST API from localhost
- Log entries: /var/log/auditd showing SELinux being switched off via the same route
- Log entries: /var/log/audit showing a bash command run through iControl REST (F5 says such lines show base64 data written into a file and /run/bigstart.ltm being run)
- Network traffic: HTTP 201 responses with a CSS content type from the appliance
- Host behavior: an Apache worker reading /proc/self/maps, changing memory permissions around libphp, binding a socket under /run, or starting /bin/bash
- SHA‑256 indicator: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9
- Weak file signal on its own: apparent changes to the three .php3 scripts — F5 warns their presence alone is not definitive
What this means for F5 BIG‑IP APM operators, the UK's NCSC, Ireland's NCSC, and CISA
Operators of BIG‑IP APM appliances should treat the advisory as operational: F5 links the c05d5254 activity to appliances affected by CVE‑2025‑53521, which F5 rated 9.8 on CVSS 3.1 (9.3 on CVSS 4.0) and said requires no login to exploit. The UK's National Cyber Security Center described BIG‑IP APM as a common component in large organizations, and Ireland's NCSC advised that the patch released in October 2025 "is still valid and will protect against exploitation."
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on March 27, 2026, giving U.S. federal civilian agencies until March 30 to act. The UK's NCSC advised investigating for compromise "regardless of when the system was updated." F5 recommends running its built‑in sys‑eicheck, collecting a qkview and raising a case so F5 can review the report, and adding memory‑to‑disk module comparisons into incident response playbooks for critical web servers.
Three operational unknowns that matter
Sophos and other published sources list three points that remain unclear: F5 has not said when exploitation began; published advisories do not state whether upgrading an appliance to a fixed release removes malware already installed (Sophos and ESET describe components designed to survive upgrade images); and no public attribution has been made — Sophos said it did not have enough evidence to name a group, and ESET said in April it had not settled the question either.
For defenders, the takeaway is immediate and technical: patching prevents future exploitation but does not by itself answer whether past compromise occurred. Investigations will need to combine file integrity checks, memory inspection, logs, and the behavioral indicators above — and, where investigation capacity is limited, the UK NCSC notes rebuilding an appliance may be the safest course even if it causes outage.
