Sophos X-Ops has found an advanced Linux rootkit that can conceal a PHP web shell completely in server memory, which makes it harder for traditional security tools to detect.
The malware was analyzed in infected environments consisting of F5 BIG-IP Access Policy Manager (APM) and was discovered by Sophos as Linux/Agnt-IC. “The malware targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments,” Sophos reported.
About the research
The research was posted on September 7, 2026, and shows how the rootkit interferes with the PHP runtime and Apache web server to deploy malicious code without making major modifications to authentic PHP files stored on the device.
A Web Shell That Does Not Remain on Disk
One significant feature of the malware is that it can install malicious PHP code directly into the running web server’s memory.
Generally, threat actors planting a PHP web shell would also modify or make a PHP file on the server. Security teams can then detect the malicious file via antivirus scans, manual investigation, or file-integrity monitoring.
The rootkit detailed by Sophos takes another approach. It changes how PHP files are shown to the running Apache process while the original files on disk are left unchanged.
This means that a file scan could demonstrate that a PHP is authentic even when the server is actively running malicious code.
Rootkit Hooks PHP and Apache
Researchers at Sophos discovered that the implant deploys various sophisticated approaches to take command over the web server. It integrates into the device’s startup process and surveys Apache activity to find out when the PHP module is loaded.
After this, the malware can bring its own web-shell functionality and change the in-memory PHP environment.
The installed web shell gets specially tailored HTTP requests and runs commands given by the threat actor. Sophos also found the implant deploying a Unix domain to socket to offer another path of communicating with an infected system and launching a shell.
This combination allows attackers several ways of maintaining access while covering the traces left on the filesystem.
Hard to detect
The attack has become a problem for experts as the malware does not always have to alter files to attack a server. Security teams should check beyond traditional file-integrity check and analyze memory activity, network traffic and running processes.
Sophos recommends that security teams look beyond conventional file-integrity checks and examine network traffic, running processes and memory activity.
Read the original article: