Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)
Severity: critical · Patch status: patched · Since 2026-11-12 · CVE-2026-109618, CVE-2026-109619, CVE-2026-123039
From 30 October 2026 an attacker hit Check Point Security Gateways whose Mobile Access portals were still unpatched, using PHP2Shell as the entry point (Check Point Research says the activity is consistent with CVE-2026-109618 and CVE-2026-109619) and then escalating from the portal service account to root through the DynamicCLI IPC interface (CVE-2026-123039, a Check Point local flaw). The operator dropped base64 PHP webshells into the portal's template directory, installed the TSGA backdoor and its TSProxy networking component (modified PhiliKit variants that ESET has associated with China-nexus UNC5221, although Check Point says several attributes do not fit that group), pivoted from the gateway to a VMware ESXi host over SSH, and ran a file-destroying wiper (destroyv6) that left a Hebrew-language note bearing the Dream Security brand. The first wave, on 30 October, hit Israeli organisations and included destructive activity; a second scanning wave on 2 November reached organisations in several countries with no destructive activity. The gateway campaign began roughly a week after the 21 October PHP fixes, so it is not part of the pre-patch exploitation window reported for PHP2Shell generally. Check Point Research, which published on 12 November, says the true nature of the operation cannot be assessed with high confidence: the actor may have run the whole campaign, acted solely as an initial access broker, or staged a false flag, and the destructive stage may be a smoke screen. The PHP flaws are in CISA KEV (added 26 October). PHP's fixed branches are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 8.1 and older receive no upstream releases. Check Point's CVE-2026-123039 fix is in Jumbo Hotfix Accumulators, and a documented workaround exists.
What to do
- Patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or a vendor backport). PHP 8.1 and older get no upstream releases: upgrade them or take them offline.
- Patch Check Point gateways to a Jumbo Hotfix Take that includes the CVE-2026-123039 fix (SK1000362: R82.20 Take 14+, R82.10 Take 52+, R82 Take 132+, R81.20 Take 174+; R81.10 and R81 are end-of-support with no take listed). If you cannot patch, SK1000362 documents a workaround (stop dynamic_server and stop it restarting); verify the exact command in the SK first, because it breaks the Dynamic CLI commands in sk144112.
- Hunt the Mobile Access portal: zz*.tpl files in the portal templates directory, /tmp/.up.tpl, challenge_render.tpl in the portal directory, PHP session files with the upload_progress_pwn marker under /opt/CPcvpn-*/tmp/, TSGA artifacts (/tmp/CPconfigdaemon, slot_CPconfigdaemon in the boot persistence directory, TCP 11072, /tmp/.p_sock) and /lib/libcpfwcommon.so.
- Review ESXi hosts reachable from gateways: SSH logins by the vpxuser account, /tmp/des wiper staging, destroy_v6 execution and DREAM_ANNEXATION.txt files. Treat any hit as a destructive incident.
- Remove internet exposure of gateway management and Mobile Access portal interfaces. Monitor for scanning from 00:00 to 09:00 UTC, the window in which Check Point saw the activity concentrated.
Fixed versions
- PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (PHP Group, 2026-10-21)
- Check Point SK1000362 (CVE-2026-123039): R82.20 Take 14+, R82.10 Take 52+, R82 Take 132+, R81.20 Take 174+
Sources
All live incidents on Threat Watch
