Sophos Reports Memory-Resident PHP Web Shell Injection on F5 BIG-IP APM Appliances

On September 7, 2026, Sophos published an analysis detailing malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. The malware does not drop a persistent file on disk. Instead, it injects a PHP web shell into the memory space of the Apache web server running on the affected appliance. When Apache loads any of the three legitimate PHP scripts native to the BIG-IP APM software, the malware adds its web shell code to the copy held in memory. Consequently, a check of the PHP scripts on disk appears clean, bypassing file integrity monitors and antivirus scans that rely on disk artifacts.

The injected web shell provides unauthorized remote access and control of the affected appliance. Because the malicious code resides only in memory, it disappears upon reboot, which can complicate incident response efforts if a system restart occurs. Sophos reports that the malware has been linked to break-in incidents, though the specific threat actor group responsible has not been definitively attributed. F5 has issued security advisories and released patches for affected BIG-IP APM versions. The company recommends that administrators apply the latest firmware, review security advisories, and monitor for indicators of compromise.

The technique highlights a growing trend in adversary tradecraft to leverage memory-resident attacks that avoid writing to disk, thereby evading traditional security controls focused on file-based detection.