Introduction

Vulnerable Check Point Security Gateway instances were compromised via PHP2Shell attacks, resulting in the deployment of data-wiping malware on VMware ESXi hosts. The attacks began on October 30 and were conducted by an actor who executed the entire campaign from initial access to lateral movement and malware deployment.

Cybersecurity Alert: Check Point Gateways Hacked via PHP2Shell to Deploy VMware ESXi Wiper

PHP2Shell Flaws

PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing unauthenticated remote code execution on vulnerable systems. These vulnerabilities were fixed by PHP with emergency patches on October 21.

Attack Campaign

The attacks started on October 30 and were initially targeted at Israeli organizations. The actor used PHP2Shell to gain access through the gateways' Mobile Access portal and then exploited a newly disclosed zero-day vulnerability, CVE-2026-123039, to gain root privileges. They then installed PHP webshells and the TSGA backdoor, embedding a networking component called TSProxy to receive commands from attackers.

Targeted Organizations

The initial wave of attacks affected Israeli organizations, while a second wave on November 2 impacted companies in multiple countries and sectors. The attackers used the gogo scanner to locate VMware ESXi hosts and deployed a data wiper called destroy_v6, which recursively deleted data in the target directory. The wiper included a zero-fill step to make recovery harder and a fast mode to skip the overwriting step.

Political Messages and False-Flag Operation

Researchers found political messages during the destructive stage, raising questions about a possible false-flag operation. The attackers left a note named DREAM_ANNEXATION.txt on the ESXi host, referencing the 'Dream Security Ltd.' and containing political messages that explicitly rejected ransom payment negotiations.

Follow-On Actions

The second wave of attacks did not include the destructive activity, but the follow-on actions taken by the threat actors remain unclear. Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways to address both PHP2Shell and the DynamicCLI privilege escalation flaw used in the attacks. Administrators should also monitor for signs of compromise, such as session files containing upload_progress_pwn, unexpected CPconfigdaemon processes, or binaries, and unexplained gaps in firewall logs.

Related Threats

Check Point warns of hackers exploiting the Security Gateway VPN RCE flaw and advises customers to monitor for unauthorized SSH activity from the gateway to internal VMware ESXi hosts. The company also highlights the importance of the blast radius in these attacks, emphasizing that the CVSS score is less critical than the potential impact of the malware deployment.

Conclusion

The PHP2Shell attacks on Check Point security gateways demonstrate the importance of timely patching and the potential for attackers to leverage multiple vulnerabilities to deploy destructive malware. The incident raises concerns about the effectiveness of existing security measures and the need for continuous monitoring and mitigation strategies to protect against such threats.

Related Articles

Keywords

Comments