Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks that ultimately deployed a data-wiping tool on VMware ESXi hosts. According to Check Point, the campaign began on October 30 and first hit Israeli organizations. A second wave on November 2 affected companies in several countries and sectors. The same actor handled the full intrusion, from initial access through lateral movement and the placement of PHP webshells.

The PHP2Shell flaws

PHP2Shell refers to two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. PHP released emergency patches on October 21. Amazon Threat Intelligence reported that exploitation attempts began four days before that. CISA added both issues to its Known Exploited Vulnerabilities catalog on October 26 and later warned that attackers were chaining them with the Fragnesia Linux kernel flaw to obtain root privileges.

Attack chain

The attacker used PHP2Shell to reach the gateway’s Mobile Access portal. It then exploited a newly disclosed zero-day, CVE-2026-123039, to escalate to root. With root access, the actor installed PHP webshells and the TSGA backdoor, which uses a networking component called TSProxy to receive commands hidden in ordinary traffic.

In the Israeli intrusions, the attacker moved from the gateway to ESXi hosts it located with gogo, an open-source network reconnaissance tool. The final payload, a wiper named destroy_v6, recursively deletes data in the target directory. It first attempts a zero fill to hinder recovery and includes a fast mode that skips overwriting.

Attribution remains unclear

The attacker left a note named DREAM_ANNEXATION.txt on at least one ESXi host that references Dream Security Ltd. The note contains political messages and rejects ransom negotiations, suggesting the goal was disruption rather than payment. Check Point tentatively linked TSGA and TSProxy to PhiliKit, a malware framework previously seen against Ivanti appliances and associated by ESET with the Chinese cluster UNC5221. The company said the evidence was insufficient for confident attribution, and the political messaging raises the possibility of a false-flag operation. Check Point also reported that the second wave did not include destructive activity, though the follow-on actions remain unclear.

Recommended actions

  • Install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing those with internet-facing Mobile Access portals. It addresses both PHP2Shell and the DynamicCLI privilege escalation flaw.
  • Hunt for session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, and unexplained gaps in firewall logs.
  • Treat unauthorized SSH connections from a gateway to internal ESXi hosts as a strong indicator of breach.