> TritonInfoSec News
Home / Sep 10, 2026 / Story
0
#8 The Hacker News general September 09, 2026 at 07:36 UTC

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

By [email protected] (The Hacker News)

AI Summary

Sophos published a September 7 analysis detailing malware targeting F5 BIG-IP Access Policy Manager (APM) appliances that injects a PHP web shell directly into Apache's in-memory process, bypassing disk-based detection entirely. The malware hooks into three specific BIG-IP PHP scripts, meaning file integrity checks return clean results while the web shell remains active in memory. Organizations running F5 BIG-IP APM should implement memory-based detection and review Sophos's indicators of compromise immediately.

Read full article → https://thehackernews.com/2026/09/f5-big-ip-apm-ma…

Relevance score: 84.0/100

# More from September 10

  1. 1
    Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days The Hacker News
  2. 2
    Chinese espionage groups swarm to exploit triple-link chain of zero-days CyberScoop
  3. 3
    Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week The Hacker News
  4. 4
    Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks BleepingComputer
  5. 5
    Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox The Hacker News
  6. 6
    Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day SecurityWeek
  7. 7
    AdaptHealth confirms 4.1 million people exposed in July cyberattack BleepingComputer
  8. 9
    SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution The Hacker News
  9. 10
    U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok The Hacker News