A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Summary + source link. No paywalls, no tracking.