AI Summary

A Linux rootkit designed for F5 BIG‑IP APM devices can intercept PHP file loading and inject a fileless web shell into memory, bypassing disk writes. The malware appears to be a second‑stage payload that was likely deployed after exploiting CVE‑2025‑53521, a critical remote code execution flaw. F5 Networks had reclassified the vulnerability from a denial‑of‑service issue in March. The rootkit’s ability to load directly into memory allows attackers to maintain persistence without leaving obvious traces on the device.

AI summaries can be wrong sometimes—always verify important details using the source article.