The technique works by hooking into the appliance's own PHP scripts. When Apache loads any of the three affected scripts, the malware appends the web shell to the in-memory copy of that script. Because the file on disk is never modified, a routine file inspection can return a clean result even while the web shell is active in memory.

The three scripts abused in this manner are:

• The appliance's own PHP scripts loaded by Apache (three in total, per Sophos)

This memory-resident approach means defenders relying solely on disk-based scanning may miss the compromise entirely. Because the injected code lives only in the running process, detection typically requires memory inspection or monitoring for anomalous behavior rather than file integrity checks.

Note: The source article does not provide specific CVE identifiers or file paths for this activity.

Source: The Hacker News
Has anyone here dealt with memory-only web shells on BIG-IP APM, and what detection approach worked for you?