Linux Rootkit Enables Fileless PHP Web Shells on F5 BIG‑IP Appliances

A new Linux‑based rootkit has been identified that gives threat actors a way to retain control over compromised F5 BIG‑IP Access Policy Manager devices without dropping traditional files on the system.

BIG‑IP appliances, particularly the Access Policy Manager module, are widely deployed to manage authentication, single sign‑on and traffic routing for corporate networks and cloud services. Their central role makes them attractive targets for attackers seeking to move laterally or exfiltrate data.

Unlike earlier malware that writes a PHP web shell to the web root, the discovered rootkit injects the shell directly into the memory space of the running web server process. By staying resident only in RAM, the code leaves no trace on the file system, complicating detection by conventional antivirus and file‑integrity tools.

Security researchers who first reported the technique observed that the shell can execute arbitrary PHP commands, allowing remote operators to issue system commands, upload additional payloads, or pivot to other hosts. Because the malicious code disappears when the process restarts, attackers often combine it with persistence mechanisms that reload the rootkit after reboot.

F5 Networks has issued an advisory urging customers to apply the latest security patches and to review configurations for unnecessary exposure of the APM interface. Experts also recommend enabling strict input validation, employing host‑based intrusion detection, and monitoring process memory for anomalous activity.

The emergence of fileless web shells reflects a broader shift toward stealthier attack vectors that evade signature‑based defenses. Organizations that rely on F5 devices are advised to incorporate behavioral analytics and to conduct regular penetration testing to uncover hidden threats before they can be leveraged for larger compromises.