PHP2Shell Exploited in Destructive Check Point Gateway Attacks
Threat actors have been exploiting PHP2Shell vulnerabilities to hack Check Point Gateway appliances and deploy a wiper against victim organizations, Check Point reports.
The attacks unfolded in two waves. An initial destructive round started on October 30 targeting Israeli organizations, while a second wave began on November 2, affecting organizations across multiple countries. PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, refers to two critical vulnerabilities leading to remote code execution and affecting all PHP versions from PHP 5 onwards.
Attack Methodology
The attackers exploited PHP2Shell for initial access, then targeted CVE-2026-123039, a local privilege escalation in the DynamicCLI process, to gain root access. They deployed PHP webshells and established persistence, followed by internal asset discovery and lateral movement to a VMware ESXi host where they deployed a wiper malware.
Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation. Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation.
Global Impact
The second wave targeted Check Point Security Gateways worldwide, including some Israeli entities from the first wave. Notably, no destructive activity was observed during this second wave. According to Check Point, the hackers operated during typical Chinese working hours and used China-linked malware and infrastructure, though their destructive tactics don't align with known Chinese cyber operations.
Neither wave showed a clear sector preference, suggesting opportunistic initial-access attempts rather than sector-specific targeting. The attackers left notes mentioning both Check Point and Dream Security, adding to the complexity of attributing the attacks.
Related
