F5 BIG-IP malware hides PHP web shell in memory

Sophos researchers discovered that malware targeting F5 BIG-IP APM appliances injects a PHP web shell directly into memory. This technique allows the threat actors to bypass standard disk-based scans, as the actual files on the storage remain unmodified and appear clean.