An attacker broke into unpatched Check Point Security Gateways by chaining the PHP2Shell flaws with a newly disclosed Check Point privilege escalation bug, then used some of the firewalls as a launchpad to wipe VMware ESXi hosts inside Israeli organizations.
Check Point disclosed the campaign on November 12, 2026, in a security advisory and a detailed technical report from Check Point Research. The company said only a couple of dozen unpatched systems, in a single region, were compromised, and that affected customers were notified in real time.
Two waves of attacks starting October 30
The first wave began on October 30 and targeted Israeli organizations through the Mobile Access portal on vulnerable gateways. Some of those intrusions ended in destructive activity. A broader second wave on November 2 hit some of the same Israeli targets along with organizations in other countries and sectors, but Check Point found no evidence of destructive activity in that round.
Check Point said exploitation activity was observed from October 30 until November 4. Neither wave showed a clear sector preference, which the researchers said points to opportunistic attempts to gain access rather than attacks on one industry.
The attacks started about one week after fixes became available. Check Point released a hotfix for PHP2Shell on October 23 and has now rolled it into its November Jumbo Hotfix.
From PHP2Shell to root on the gateway
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws that allow unauthenticated remote code execution. BreachNews first reported on PHP2Shell when attacks began in October. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26.
On Check Point gear, PHP2Shell affects the Mobile Access portal on Security Gateways running every version from R80 to R82.20, as well as several Spark firewall releases. Check Point rates the issue 9.2 on the CVSS scale.
After getting in through the portal, the attacker escalated from the portal’s service account to root by exploiting CVE-2026-123039, a local privilege escalation flaw in the Gaia OS Dynamic CLI service. The bug carries a CVSS score of 7.8 and affects Gaia R81.20, R82, R82.10 and R82.20. Check Point tracks it in sk1000362. It was not in CISA’s Known Exploited Vulnerabilities catalog as of the agency’s latest update on November 10.
With root access, the attacker planted PHP webshells in the directory the portal uses to build its login pages. The researchers found several template files named in a zz*.tpl pattern, each starting as a small command shell that was later swapped for a more capable version able to run system commands, execute PHP code and upload files.
A firewall backdoor built for Check Point devices
The attacker then launched a backdoor Check Point calls TSGA, first dropped as /tmp/CPconfigdaemon. When it runs as root, it relocates itself and relaunches as slot_CPconfigdaemon so it survives reboots.
According to the report, TSGA gives the operator encrypted remote access and can steal the gateway’s configuration, persist through backups and snapshots, inject into other processes and tamper with the firewall’s binary logs. It also carries a second component, TSProxy, written to /lib/libcpfwcommon.so and loaded into selected appliance processes. TSProxy hides attacker connections inside normal traffic and supports encrypted proxying into the network.
Wiper deployed on VMware ESXi hosts
From the gateway, the attacker ran the open-source gogo scanner to map internal systems, then moved to a VMware ESXi host over SSH using the vpxuser service account. There, the attacker deployed a Linux wiper named destroy_v6.
The wiper walks through a target directory and deletes every file regardless of type. By default it overwrites files with zeros first to make recovery harder, and a fast mode skips that step. It drops a note named DREAM_ANNEXATION.txt in each directory it processes.
Check Point said the note is written in Hebrew, refers to the Israeli-Palestinian conflict, uses the brand of Israeli security firm Dream Security and explicitly rejects any ransom negotiation. Check Point described the destructive cases as ideologically motivated.
Tools linked to a China-nexus framework, but attribution is unclear
Check Point found that TSGA and TSProxy are modified versions of PhiliKit, a malware framework previously seen in attacks on Ivanti VPN appliances. ESET has associated PhiliKit with the China-nexus cluster UNC5221. The tools share code, configuration, credentials and even a TLS certificate and private key with earlier PhiliKit samples.
Other clues point the same way. The attacker’s servers were hosted on LightNode VPS infrastructure, which has been tied to Chinese-nexus activity, and scanning ran mostly between 00:00 and 09:00 UTC, which lines up with working hours in China.
However, the researchers said a destructive operation focused on Israel, with a Hebrew political note, does not fit the usual motives of known China-nexus groups. Check Point said it cannot assess the operation’s true nature with high confidence. The attacker may have run the whole campaign, may have only sold or handed off access, or may have staged a false-flag operation. The wiping could also have been a smoke screen.
Dream had recently published research on China-nexus actors exploiting PHP2Shell on Palo Alto Networks devices. Check Point said that timing raises the possibility of retaliation, but the evidence does not establish a clear motive. Dream had not issued any public statement at time of publication.
What Check Point customers should do
Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways as soon as possible, starting with gateways that expose the Mobile Access portal to the internet. The update also fixes two other Gaia bugs that were not exploited in these attacks: CVE-2026-107484 (CVSS 7.3) and CVE-2026-120490 (CVSS 3.8).
Administrators of gateways that were exposed before patching should look for signs of compromise, including:
- PHP session files containing the string
upload_progress_pwn - Processes or binaries named in a
CPconfigdaemonpattern posing as Check Point components - Scanner or wiper tools dropped under
/tmpor/temp - A note referencing “Dream Annexation” with no payment demand
- Unexplained gaps in firewall traffic logs, especially after a logging daemon crash
- Unexpected SSH sessions from the gateway to internal VMware ESXi hosts
- Connections from the scanning addresses 130.94.19[.]204 and 130.94.19[.]168
Check Point warned that the absence of these indicators does not rule out a compromise. The full list of file hashes is in the Check Point Research report.
Attackers have gone after Check Point gateways before. BreachNews previously covered a Check Point VPN zero-day tied to Qilin-linked activity.
BreachNews will update this story if Check Point shares more on the number of affected organizations or if CVE-2026-123039 is added to CISA’s Known Exploited Vulnerabilities catalog.
