An unidentified threat actor breached Check Point Security Gateway appliances in a series of PHP2Shell attacks that chained critical web vulnerabilities with a zero-day flaw in Gaia OS [1]. The activity began on October 30, 2026, initially hitting Israeli organizations before widening into a global campaign on November 2 [2]. Intruders used their foothold to plant web shells, deploy the persistent TSGA backdoor, and pivot into internal VMware ESXi hypervisors to execute destructive wiper malware [1]. Check Point released security updates to resolve both flaws across supported gateways [2].
How PHP2Shell Attacks Began
The initial breach path relied on two flaws in the PHP engine, cataloged as CVE-2026-109618 and CVE-2026-109619, which permit unauthenticated remote code execution on internet-facing systems. Upstream maintainers released emergency patches on October 21, 2026. Live exploitation began earlier. Amazon Threat Intelligence detected attack traffic four days before those official software fixes appeared [1].
Federal authorities recognized the severity when the Cybersecurity and Infrastructure Security Agency added both PHP2Shell bugs to its Known Exploited Vulnerabilities catalog on October 26 [1]. Check Point researchers observed that the adversary focused intrusion attempts on the Mobile Access portal of its Security Gateways, routing malicious traffic from the IP address 130.94.19[.]204. The campaign opened with targeted strikes against Israeli organizations in late October [2]. On November 2, a second wave hit commercial targets in multiple countries without showing geographic or sector bias. While the initial wave paired access with destructive wiping code, the follow-on wave omitted wiping routines, leaving researchers unsure whether the actors sought intelligence or intended to sell unauthorized access [1].
Web perimeter gateways remain attractive entry points for network intrusion, contrasting with web-layer attacks where threat actors target a critical WordPress flaw for code execution on shared hosting servers. Following initial PHP2Shell attacks against the perimeter, the adversary operated as a self-contained crew that handled every phase from perimeter breach to host destruction. The group didn’t rely on third-party access brokers to complete its mission [1].
Privilege Escalation and Backdoors
Initial compromise of the Mobile Access portal left the attackers confined to an unprivileged service account on Gaia OS. They overcame that barrier by weaponizing a zero-day vulnerability tracked as CVE-2026-123039, which carries a CVSS score of 7.8. The flaw exists within the DynamicCLI process socket, where missing authorization checks permit any authenticated local user to execute commands as root by sending a single crafted request. “The issue is a local privilege escalation and requires the attacker to already have local code execution on the appliance,” Check Point said, noting it observed active exploitation against dozens of enterprise customers. The vendor confirmed the flaw affected versions R81 through R82.20 across firewalls, management servers, and Maestro orchestrators [2].
With administrative control secured, the attackers dropped PHP web shells to preserve command execution and file transfer capabilities on the host. They followed by deploying a stealthy backdoor dubbed TSGA, disguised as a service component named slot_CPconfigdaemon. TSGA functions as a gateway implant tailored for Gaia OS. It provides encrypted remote management, extracts proprietary configurations, preserves access across firmware snapshots, and modifies binary firewall logs to hide attacker footprints [2].
The backdoor package also incorporates a network interception library named TSProxy [1]. “The injection code loads this library into selected appliance processes, where it intercepts networking functions to handle specially marked attacker connections while allowing ordinary traffic to continue,” Check Point said. By filtering and processing marked packets within existing services, the implant operates without opening unusual listening ports. Normal administrative traffic passes through the appliance unimpeded, concealing the illicit communications from network monitoring utilities. This dual-stage persistence model enabled the intruders to retain control over the gateway without triggering automated connection alerts [2].
Lateral Movement and Wiper Deployment
Following successful PHP2Shell attacks on perimeter gateways, the intruders initiated internal network reconnaissance using an open-source tool named gogo scanner. The automated utility scanned internal subnets to identify reachable hypervisors. The actors focused specifically on VMware ESXi servers hosting production virtual machines, treating the perimeter gateway as a trusted launchpad for internal lateral movement [1]. Network appliances serve as effective vantage points for lateral discovery because perimeter firewalls often permit management connections originating from the gateway itself [2].
The intrusion shifted from reconnaissance to active compromise when the threat group opened SSH connections from the gateway to adjacent ESXi hypervisors, authenticating with the built-in vpxuser service account. Upon gaining shell access on the virtualization host, the actors deployed an ELF wiper binary identified as destroy_v6. The wiper traverses directory structures recursively, deleting all files regardless of extension or file type [2]. To hinder digital forensics, destroy_v6 writes zero bytes across storage blocks before unlinking file metadata. The software also supports an optional fast mode that bypasses zero-filling to purge data volumes rapidly when time is constrained [1].
In every wiped directory, the attackers deposited a ransom note titled DREAM_ANNEXATION.txt. The note referenced Dream Security Ltd. and featured political statements addressing the Israeli-Palestinian conflict. The text explicitly rejected financial extortion negotiations, stating that the perpetrators sought sole destruction of target systems [1]. The wiping activity halted operations across compromised virtualization clusters [2].
Threat Actor Attribution Scenarios
Investigators identified tangible links connecting the tooling in this campaign to known cyber espionage operations [1]. Check Point noted that the TSGA backdoor and TSProxy module share technical ancestry with PhiliKit, a malware framework documented by ESET in June 2026. ESET linked PhiliKit to Armory Castle, an espionage group formerly designated as UNC5221 that previously compromised enterprise perimeter hardware manufactured by Ivanti. The implant architecture shows detailed familiarity with appliance firmware internals [2].
Network telemetry also revealed working patterns linked to Chinese time zones. Attack traffic routed through virtual private servers managed by hosting provider LightNode. Furthermore, command activity and gateway probes concentrated between 12 a.m. and 9 a.m. UTC, matching standard business working hours in Beijing. While these timing distributions and hosting choices align with historical Chinese state-sponsored operations, investigators caution that infrastructure sharing and deliberate misdirection can obscure true origins [2].
Because destructive wiping runs counter to customary state intelligence collection, Check Point declined to attribute the campaign conclusively to Armory Castle. “Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation,” Check Point said. Several plausible scenarios could explain the contradictory forensic evidence. The identified threat actor might have managed the entire campaign independently, or an initial access broker could have passed entry credentials to an unaffiliated destructive entity. Alternatively, the wiping code and political notes might have served as a false-flag operation designed to mislead investigators, or as a destructive smoke screen deployed to mask deeper data theft [2].
Defenses Against PHP2Shell Attacks
To block incoming PHP2Shell attacks, Check Point advised customers to install the November Jumbo Hotfix across all internet-exposed Security Gateways and Management Servers. The update resolves both the underlying PHP vulnerabilities and the DynamicCLI privilege escalation flaw identified as CVE-2026-123039 [1]. Systems requiring remediation include Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management platforms, and Maestro Orchestrator appliances running Gaia OS versions R81, R81.10, R81.20, R82, R82.10, and R82.20 [2]. Administrators should prioritize gateways hosting public Mobile Access portals, as these endpoints served as the primary entry point for perimeter exploitation. Organizations can apply the patch package through standard hotfix accumulation utilities [1].
System administrators must also audit gateway appliances for indicators of past compromise. Defenders should inspect web session logs for references containing upload_progress_pwn, which signals attempts to manipulate file upload buffers via PHP2Shell. Server inspection should verify active system processes to detect anomalous instances of CPconfigdaemon or unrecognized executable files running from temporary paths. Unexplained gaps in firewall log records warrant forensic review, as does any unauthorized SSH session originating from a perimeter gateway toward internal VMware ESXi hypervisors [1].
- ONLINE NEWS Toulas, B. (2026, November 13). Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper. BleepingComputer. [Article Link]
- ONLINE NEWS The Hacker News. (2026, November 13). Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files. The Hacker News. [Article Link]
