Malware hides web shell in F5 BIG-IP APM memory
Security researchers report that new malware infecting F5 BIG-IP Access Policy Manager appliances installs a web shell directly into server memory, bypassing standard file-based detection methods. The attack exploits a vulnerability (CVE-2025-53521) that F5 reclassified as remote code execution in March 2026. The exploit does not require user authentication. Both installers affecting the Apache binary and the in-memory web shell have been analyzed, but no victims are named.
- Malware goes undetected by file scans
- Targets enterprises using F5 BIG-IP APM
- Exploits critical CVE-2025-53521 flaw
- Attack confirmed to work without login
- Second-stage payload persists after upgrades
Sources covering this
More in Cybersecurity
Microsoft releases record number of security patches
Microsoft released updates to fix at least 974 security vulnerabilities across Windows and other products, its largest patch release to date. The update includes critical flaws, some already being exploited, and over 100 rated as dangers that could let attackers seize control of systems. The unprecedented volume is partly due to the use of AI for vulnerability detection, but experts warn that rapid growth complicates efforts to test and deploy fixes.
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Liquid Network exploit creates $320 million in unbacked bitcoin
Attackers exploited a software bug in Blockstream's Liquid Network, a Bitcoin sidechain, creating about 4,000 unbacked Liquid Bitcoin (L-BTC) and withdrawing $320 million. The attackers identified themselves as white hat hackers and have returned most funds, retaining around $47 million. According to Blockstream, the incident did not involve compromised multisig keys but was caused by a vulnerability in recent node software.
Google patches Chrome zero-day actively exploited
Google has fixed a Chrome vulnerability that was already being exploited, tracked as CVE-2026-87491. The bug is found in Chrome's V8 engine and allows remote attackers to run code within the browser sandbox via a specially crafted HTML page. The issue has been resolved in the latest Chrome update, which covers 230 security flaws. Google released limited details while the patch is being rolled out.