PHP2Shell Exploitation on Check Point Gateway
Starting October 30, 2026, attackers targeted organizations with unpatched Check Point Security Gateways using PHP2Shell for initial access, followed by destructive activity against some Israeli targets.
The campaign began on October 30, 2026, when attackers scanned and exploited organizations with unpatched Check Point Security Gateways using Mobile Access portals. The initial wave targeted Israeli organizations, with some experiencing destructive activity. A broader second wave on November 2 targeted organizations across multiple countries and sectors without destructive elements.
Exploitation Chain
The attackers used PHP2Shell to gain initial access through vulnerable Mobile Access portals, exploiting CVE-2026-109618 and CVE-2026-109619. They then escalated privileges to root by exploiting CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI interface.
After gaining root access, the attackers deployed PHP webshells in the portal's templates directory and established persistence through the TSGA backdoor and its embedded TSProxy networking component. These tools are modified variants of PhiliKit, a malware framework previously documented in attacks exploiting Ivanti vulnerabilities.
Destructive Activity
In some cases, the attackers pivoted from the gateway to a VMware ESXi host over SSH, deploying the destroy_v6 wiper and leaving politically themed DREAM_ANNOVATION.txt notes during the destructive stage. The wiper recursively deletes files and overwrites them with zeros before deletion, with an option to skip the overwrite process for faster deletion.
This politically themed note includes a timestamp and explicitly rejects ransom negotiations.
Attribution Uncertainty
While TSGA and TSProxy share code and cryptographic material with PhiliKit, which has been associated with China-nexus UNC5221, the evidence doesn't allow high-confidence attribution. Several scenarios remain possible, including the actor acting as an initial access broker or participating in a false-flag operation.
The destructive activity focused on Israel and included a wiper note in Hebrew referring to the Israeli-Palestine conflict. Although Dream Security had recently published research on PHP2Shell exploitation by China-nexus actors, the available evidence doesn't establish a clear motive for retaliation.
Related
