Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Threat actors compromised vulnerable Check Point Security Gateway instances by exploiting two critical PHP vulnerabilities known as PHP2Shell and chained them with a zero-day flaw to deploy destructive data wipers on internal VMware ESXi hosts. According to details compiled in BleepingComputer's report, the intrusion campaign began on October 30 targeting organizations in Israel before expanding internationally. The threat group managed every stage of the operation, establishing initial perimeter access, deploying webshells, elevating privileges to root, and wiping enterprise virtualization infrastructure.

This report breaks down the complete attack chain, covering the exploited vulnerabilities, the lateral movement tooling, the destructive wiper execution, and the recommended defensive measures. It is written for security operations personnel, firewall administrators, and system engineers responsible for enterprise perimeter gateways and virtualization clusters.

01Critical PHP flaws and early exploitation timeline

The intrusion campaign relied on two critical security defects in PHP known collectively as PHP2Shell and tracked under identifiers CVE-2026-109618 and CVE-2026-109619. These vulnerabilities allow unauthenticated attackers to achieve remote code execution on unpatched systems. Maintainers of the PHP project released emergency software updates to address both flaws on October 21.

Telemetry gathered by Amazon Threat Intelligence revealed that threat actors launched active exploitation attempts against the vulnerabilities on October 17, four days prior to the public availability of official patches. The Cybersecurity and Infrastructure Security Agency subsequently added both vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26.

CISA also issued a supplementary alert warning network defenders that malicious actors were actively chaining the PHP2Shell bugs with the Fragnesia Linux kernel vulnerability. Combining these flaws enabled attackers to bypass security restrictions and obtain root privileges on vulnerable server platforms.

02Mobile Access portal breach and root escalation

Adversaries gained initial ingress into enterprise networks through Check Point Security Gateways by targeting the built-in Mobile Access portal using the PHP2Shell exploit. Once inside the perimeter appliance, the attackers weaponized a newly disclosed zero-day privilege escalation vulnerability tracked as CVE-2026-123039 to secure full root control over the operating system.

Having established root privileges, the threat actor installed persistent PHP webshells alongside a specialized implant known as the TSGA backdoor. This malware incorporates an embedded networking utility dubbed TSProxy, which monitors incoming network traffic to intercept commands transmitted by operators while concealing communication within routine operational exchanges.

The combination of DynamicCLI privilege escalation and the TSGA backdoor granted the operator persistent, undetected access to the perimeter environment. From this vantage point within the gateway appliance, the intrusion set maintained durable command execution capabilities while preparing internal reconnaissance against downstream virtualization hardware.

03Lateral movement scanner and data wiper payload

During the destructive campaign against Israeli organizations, the attackers pivoted away from the compromised perimeter gateway toward internal VMware ESXi hypervisors. The threat actor located these virtualization assets across corporate subnets by running the gogo scanner, an open-source network reconnaissance utility designed to discover reachable network services.

Upon accessing the targeted ESXi hosts, the operators launched a dedicated data-wiping program labeled destroy_v6. The wiper recursively deletes all files within targeted directory trees, attempting an initial zero-fill overwrite routine to prevent forensic data recovery while retaining a fast execution mode that bypasses the overwriting process.

Breached hypervisors also contained a dropped text file titled DREAM_ANNEXATION.txt referencing an entity named Dream Security Ltd. The note embedded explicit political messaging while firmly rejecting any possibility of ransom negotiations, underscoring that the primary goal of the operators was deliberate data destruction and business disruption.

04Attribution puzzles across two attack waves

Security researchers observed that the intrusion campaign unfolded in two distinct temporal waves. The first wave began on October 30 and specifically targeted Israeli entities with destructive payloads, whereas the second wave emerged on November 2, affecting organizations across multiple countries and diverse commercial sectors.

Check Point analysts observed that the second wave omitted the destructive wiping routine seen in the earlier phase, though follow-on activities conducted by the attackers remain unconfirmed. In addition, the presence of overtly political notes during the initial destructive stage raised unresolved questions regarding a potential false-flag operation.

Investigators tentatively connected the TSGA backdoor and its TSProxy networking module to PhiliKit, a framework previously observed in campaigns targeting Ivanti appliances. Security firm ESET previously linked PhiliKit to the Chinese cyber espionage cluster UNC5221, but analysts emphasize that available evidentiary artifacts prevent high-confidence attribution to any known group.

05November Jumbo Hotfix and breach indicators

Check Point published the November Jumbo Hotfix and advised administrators to deploy the update across all Management Servers and Security Gateways immediately. Engineering teams should prioritize internet-exposed appliances operating the Mobile Access portal, as the hotfix remediates the underlying PHP2Shell flaws and the CVE-2026-123039 DynamicCLI privilege escalation vulnerability.

Defenders must also inspect previously exposed gateway instances for specific forensic indicators of compromise. Key warning signs include session files containing upload_progress_pwn strings, unexpected running processes or executable binaries associated with CPconfigdaemon, and unexplained historical gaps within gateway firewall logs.

Security teams should audit network traffic for unauthorized SSH connections originating directly from the perimeter security gateway to internal VMware ESXi hypervisors. Detecting lateral management protocol traffic bridging perimeter appliances and internal hypervisors indicates an active compromise requiring immediate network isolation and forensic host acquisition.