Sophos published analysis on 7 September 2026 of malware found on F5 BIG-IP Access Policy Manager, the appliance component that decides who is allowed through the edge into an organisation.

The chain is worth following step by step, because each step is chosen to defeat a specific control.

How the shell gets into memory

An installer named umount prepends malicious code to the Apache binary at /usr/sbin/httpd. When Apache loads, that code hooks the runtime function apr_dso_load and waits for the PHP module. The moment PHP loads, it reads /proc/self/maps, makes memory pages writable, and rewrites the file-access calls. Then it waits for 3 specific scripts and inserts the web shell in front of the original content.

The three are apm_css.php3, full_wt.php3 and webtop_popup_css.php3.

Sophos's own summary of why that matters: "The web shell does not need to exist in its final form on disk."

Which control that defeats, precisely

File integrity monitoring on an appliance compares files against known-good copies. Those 3 .php3 files on disk are unmodified: they hash correctly, and a diff against the vendor image comes back clean. The shell is assembled in memory as the file is read, so the artefact you would compare never touches the filesystem. That is what Sophos means by the shell not needing to exist in its final form on disk.

F5 notes that changes to those three scripts do not on their own confirm compromise — which cuts both ways, because their absence does not clear you either.

The HAProxy implant last week reached the same destination differently, by being version-identical to a clean build. Both are the same idea: do not evade the check, arrange for the check to pass.

What the shell does

It reads HTTP request bodies looking for a marker, decrypts the remainder, and executes the command. It answers with HTTP 201 and a CSS content type, so the traffic reads as a stylesheet response rather than as command output.

It also opens a local socket at /run/bigtlog.pipe giving bash access without any network exposure — so an operator who is already on the box does not need to touch the network path at all.

ESET reports the malware is built to survive upgrades by infecting installation images covering umount, httpd and rc.local. The usual remediation for a compromised appliance is to rebuild it, and this is designed for exactly that.

The entry point was filed as a denial of service

CVE-2025-53521 is the way in: unauthenticated remote code execution, CVSS 9.8/9.3, affecting BIG-IP APM where an access policy is configured on virtual servers.

Published in October 2025 as a denial of service, it was reclassified on 27 March 2026 as unauthenticated remote code execution, after exploitation was discovered. A denial of service on an edge appliance is a real issue and a routine one: it goes in the next maintenance window, behind anything that grants access. That was a correct decision on the information published, and it was wrong for 5 months.

The patch has existed since October 2025. The reason to install it changed in March 2026, and nothing about the CVE identifier changed to make anyone look again.

This is the argument for re-reading old advisories rather than trusting the triage you did when they landed. Classifications move, and nothing notifies you.

Indicators

Files and processes:

  • /run/bigtlog.pipe or /run/bigstart.ltm present
  • Size or timestamp mismatches on /usr/bin/umount or /usr/sbin/httpd
  • Changes to the three .php3 scripts, which F5 notes are not confirmation on their own

SHA-256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9

Behaviour, which is where the real signal is:

  • Apache workers reading /proc/self/maps
  • Memory permission changes around libphp
  • Socket binding under /run
  • Bash spawning via the iControl REST API
  • HTTP 201 responses carrying a CSS content type
  • SELinux being disabled through iControl REST

Logs: /var/log/restjavad-audit showing local iControl REST access, /var/log/auditd showing SELinux modification, and /var/log/audit showing base64 data writes and /run/bigstart.ltm execution.

What to do

  • Patch CVE-2025-53521 if you have not. The fix has been available since October 2025 across the 15.1.0 to 17.5.1 range.
  • Stop hunting by file hash on this one and hunt by behaviour. An Apache worker reading its own memory map is not normal, and it is the cheapest detection in the list.
  • Check for the two socket paths first. They are the fastest yes-or-no available.
  • Do not assume a rebuild clears it. ESET says the malware targets installation images specifically.
  • Re-read your October 2025 triage decisions. This CVE changed category five months after you filed it.

What is not established

  • Whether patching removes an existing infection. F5 has not said.
  • When exploitation actually began relative to the October 2025 disclosure.
  • Who is behind it. Sophos says it lacks evidence to attribute; ESET was undecided as of April 2026.
  • How widespread it is. A single sample was analysed, and Sophos withheld the victim and how it obtained the sample.