When the web shell isn’t on disk: the F5 BIG-IP rootkit that lives in memory

· · Sept. 14, 2026, 12:36 p.m.
Security dfir Linux Rootkits Cybersecurity Linux Incident Response web-security
Summary
The post discusses a Linux rootkit that targets F5 BIG-IP APM environments, focusing on a PHP web shell concealed within Apache process memory. This revelation challenges traditional file-centric incident response approaches in cybersecurity.
Read full post on andreafortuna.org →
AUTHOR