When the web shell isn’t on disk: the F5 BIG-IP rootkit that lives in memory

· · Sept. 14, 2026, 12:36 p.m.
Linux Security dfir memory-forensics Cybersecurity Linux Incident Response web-security
Summary
The post discusses a Linux rootkit that targets F5 BIG-IP APM environments, focusing on a PHP web shell concealed within Apache process memory. This revelation challenges traditional file-centric incident response approaches in cybersecurity.
Read full post on andreafortuna.org →
AUTHOR
Advertise
Sponsor diff.blog
Put your product in front of developers who read and write about their craft. One exclusive sponsor at a time.
Become a sponsor →