Attackers have chained the PHP2Shell remote-code-execution flaws with a newly disclosed Check Point privilege-escalation vulnerability to compromise internet-facing Security Gateways, establish persistence and, in some cases, wipe VMware ESXi systems. Check Point Research said the activity began on Oct. 30, roughly a week after fixes became available, with a destructive first wave targeting Israeli organizations followed by broader scanning on Nov. 2.
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, a pair of unauthenticated flaws affecting Check Point Mobile Access portals. Check Point rates the vulnerabilities 9.2 on the CVSS scale and lists Security Gateway releases from R80 through R82.20 as affected, along with several Spark Firewall branches. The initial foothold gave attackers code execution in the portal service, but did not by itself provide root access.
Attackers then exploited CVE-2026-123039, a local privilege-escalation flaw in Gaia OS’s DynamicCLI service. NVD lists affected Quantum Security Gateway and Security Management versions as R82.10 with Jumbo Hotfix Take 50 or earlier, R82.20 with Take 10 or earlier, R82 with Take 130 or earlier, and R81.20 with Take 173 or earlier. Check Point assigns the vulnerability a CVSS score of 7.8 and says it has been exploited in the wild.
After reaching root, the intruders placed PHP web shells in the Mobile Access portal’s template directory and deployed the TSGA backdoor, together with its embedded TSProxy networking component. Check Point researchers said the malware can provide encrypted remote access, configuration theft and log tampering. The attackers also used a scanner to identify internal systems before moving over SSH to VMware ESXi hosts, where they deployed the destroy_v6 wiper and left politically themed DREAM_ANNEXATION.txt notes that did not demand payment.
The tooling shares code, configuration and cryptographic material with PhiliKit, a malware framework previously linked to attacks on Ivanti appliances. Check Point said that connection is consistent with activity associated with the China-nexus UNC5221 cluster, but cautioned that the evidence does not support high-confidence attribution. The researchers said the operation could involve the identified actor, an access broker or a false-flag effort, and that the destructive activity may have been intended as a smokescreen.
Check Point reported that only a couple of dozen unpatched systems in one region were compromised in the incidents it investigated, but urged customers to treat exposed Mobile Access portals as a priority. Administrators should install the vendor’s November Jumbo Hotfix on all Security Gateways and Management Servers, beginning with internet-facing deployments, and investigate for PHP session files containing upload_progress_pwn, files named CPconfigdaemon, unexplained traffic-log gaps, unauthorized SSH connections to ESXi hosts and the listed wiper note. The vendor’s security advisory and technical report provide additional indicators and response guidance.
