Hackers have successfully breached F5 BIG-IP APM devices, deploying a Linux rootkit that can intercept PHP file loading. This rootkit is particularly concerning because it can inject a fileless web shell directly into the device's memory, which means it doesn't leave malicious code on the disk, making detection more challenging. Organizations using F5 BIG-IP APM solutions could be at risk, as the attackers can exploit these vulnerabilities to gain unauthorized access. This situation emphasizes the need for heightened security measures and vigilance among companies that rely on these devices to protect sensitive data. Users should be aware of the potential for exploitation and take immediate action to secure their systems.