Back Gbhackers

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

Gbhackers •Divya • November 13, 2026

Attackers are exploiting a remote code execution vulnerability in PHP2Shell , combined with a newly disclosed local privilege escalation flaw, to take over unpatched Check Point Security Gateways.

This lets them gain root access and, in some cases, wipe VMware ESXi hosts. Check Point has reported active exploitation of the second flaw, identified as CVE-2026-123039, affecting several dozen customers.

Check Point PHP2Shell Flaws

The activity began on October 30, 2026, when attackers scanned and targeted organizations running vulnerable Mobile Access portals. The initial wave focused on Israeli organizations and included destructive activities against some of them.

A broader wave commenced on November 2, impacting multiple countries and sectors. However, no evidence of destruction was noted during this phase. This pattern indicates that the attackers are seeking opportunistic access rather than targeting specific sectors.

The activity traced back to the IP address 130.94.19[.]204 began approximately one week after a security fix was made available. The attackers used PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619, as their entry point.

CVE-2026-123039 carries a CVSS score of 7.8. The Gaia OS Dynamic CLI runs as a root process, dynamic_server, that listens on /tmp/dynamic_socket.

The socket is world-writable (0777) and does no authentication, so any local user can run commands as root by writing one request to it. The flaw affects R81 through R82.20 on firewalls, management and log servers, Multi-Domain servers and Maestro Orchestrator.

Spark Firewalls and Smart-1 Cloud are not affected. This is the latest in a string of attacks on the vendor’s products, following an actively exploited management server zero-day earlier this autumn.

After exploiting the portal, the attackers escalated to root and wrote PHP webshells named zz*.tpl into the Mobile Access templates directory. Investigators found session files containing the upload_progress_pwn marker and hundreds of Apache/PHP segmentation faults.

The upgraded webshell requires the hardcoded key zz2026, runs OS commands and PHP code, and accepts uploads to /tmp/.up.tpl. The attackers then launched the TSGA backdoor from /tmp/CPconfigdaemon, which relocates itself as slot_CPconfigdaemon.

It also drops TSProxy as /lib/libcpfwcommon.so, which hooks networking functions in appliance processes to handle specially marked attacker connections.

TSGA offers encrypted remote access on TCP port 11072, configuration theft, process injection, and firewall-log tampering. Both tools are modified variants of PhiliKit.

UNC5221 is a suspected China-nexus group known for exploiting Ivanti Connect Secure appliances . TSProxy shares credentials, transport secrets, and a TLS certificate with PhiliKit’s libdssafe.so, which strongly supports a shared lineage.

From the gateway, the attackers ran the gogo scanner to map internal assets. They then pivoted over SSH to a VMware ESXi host using the vpxuser account and executed the destroy_v6 wiper. The Linux ELF wiper overwrites files with zeros before deleting them, and its -f flag skips the overwrite.

It leaves DREAM_ANNEXATION.txt in each directory, a politically themed note that rejects ransom talks. Hypervisor-focused destruction is a growing tactic, as seen when LockBit 5.0 added an ESXi build .

Attribution is unsettled. Infrastructure on LightNode VPS and scanning between 00:00 and 09:00 UTC point to Chinese working hours. The destructive aim, Israel focus, and Hebrew note do not fit UNC5221’s usual motives.

Administrators should install the fixed Jumbo Hotfix Accumulators: R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. As a stopgap, disable dynamic_server with dbset process:dynamic_server, then dbset :save.

Hunt for non-Clish commands in /var/log/dynamicCli.log and for “Rejected connection from unauthorized uid” entries. Confirm /tmp/dynamic_socket is set to 0660, given the CISA KEV listings for other Check Point flaws , patch quickly.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs :

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Hackers Manipulate NVIDIA GPU Monitoring to Conceal Cryptocurrency Mining on Compromised Linux Servers

FBI Disrupts North Korean FaceStealer Attacks Linked to $400 Million in Crypto Theft

Hackers Exploit ChatGPT and Claude Website Typos to Deliver Malware and Hijack Browsers

Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners

Hackers Disguise XLoader Malware as Purchase Order Confirmations to Infect Windows Computers

OpenAI Launches Advanced AI Cybersecurity Tools for Automated Penetration Testing and Vulnerability Research

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware Beginning on October 30, 2026, attackers exploited unpatched vulnerabilities in Check Point Security Gateways, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) and a local privilege escalation vulnerability (CVE-2026-123039). The initial wave targeted Israeli organizations, leading to root access and the deployment of a persistent backdoor named TSGA, which facilitated destructive actions against VMware ESXi hosts. A second wave on November 2 expanded the attack to multiple countries without destructive outcomes. Check Point confirmed that the attackers exploited these vulnerabilities to gain access, escalate privileges, and deploy wiper malware. The campaign is characterized as opportunistic rather than sector-specific, with evidence of active exploitation against a couple of dozen customers. The vulnerabilities were publicly disclosed shortly before the attacks, with patches available but not applied by the affected organizations. 14 sources 73

Extracted Entities

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Countries (2)

CVEs (3)

CWE Weaknesses (2)

Domains (2)

IP Addresses (1)

Malware (5)

MITRE ATT&CK (5)

Platforms (3)

Ransomware Groups (1)

Tools (2)