Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts.

The attacks started on October 30, initially against Israeli organizations, and were conducted by an actor that ran the entire campaign, from initial access to lateral movement and launching PHP webshells.

In some instances, researchers found political messages during the destructive stage, raising questions about a possible false-flag operation.

PHP2Shell is the name for two critical PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on vulnerable systems.

PHP fixed the vulnerabilities in emergency patches on October 21. However, according to Amazon Threat Intelligence, exploitation attempts started four days earlier.

CISA added both issues to its Known Exploited Vulnerabilities (KEV) catalog on October 26 and later warned that attackers were chaining PHP2Shell bugs with the Fragnesia Linux kernel flaw to gain root privileges.

Cybersecurity company Check Point says that the first exploitation wave targeted Israeli organizations, while a second one on November 2 affected companies in multiple countries and sectors.

The attacker used PHP2Shell to gain access through the gateways’ Mobile Access portal, then exploited a newly disclosed zero-day vulnerability tracked as CVE-2026-123039 to gain root privileges.

Then they abused the privileges to install PHP webshells and the TSGA backdoor, which embeds a networking component called TSProxy to listen for attacker commands concealed within regular traffic.

In the attacks targeting Israeli organizations, the threat actors moved from the gateway to VMware ESXi hosts located using the gogo scanner, an open-source network reconnaissance tool.

In the last stage of the attack, the threat actor deployed a data wiper called destroy_v6 that recursively deletes data in the target directory.

The wiper first tries a zero fill to make recovery harder. It also supports a fast mode that skips the overwriting step.

Check Point also found that the attacker left on the ESXi host a note named DREAM_ANNEXATION.txt that references the ‘Dream Security Ltd.’

The note contains political messages and explicitly rejects ransom payment negotiations, indicating that the attackers’ sole goal is to cause damage and disruption.

Check Point tentatively linked TSGA and TSProxy to PhiliKit, a malware framework previously seen in attacks on Ivanti appliances and which ESET associated with the Chinese threat cluster UNC5221.

However, the attacks could not be attributed with confidence based on the available evidence.

According to the researchers, the second wave did not include the destructive activity, but the follow-on actions the threat actors took remain unclear.

Check Point recommends that customers install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing those with internet-facing Mobile Access portals.

The update addresses both PHP2Shell and the DynamicCLI privilege escalation flaw used in the attacks.

Administrators should also check for signs of compromise on previously exposed gateways, including session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, and unexplained gaps in firewall logs.

Unauthorized SSH activity from the gateway to internal VMware ESXi hosts is also a clear sign of breach.