Attackers exploited two PHP2Shell flaws in unpatched Check Point Security Gateways to gain an initial foothold, then abused a third vulnerability to obtain root access before installing a persistent backdoor and moving to VMware ESXi hosts to wipe files. In a report published on November 12, Check Point Research said the first wave targeted Israeli organizations on October 30, while a broader wave on November 2 reached organizations in multiple countries and sectors.
The intrusions began with PHP2Shell exploitation of CVE-2026-109618 and CVE-2026-109619 in Mobile Access portals. After gaining access to the portal service account, attackers exploited CVE-2026-123039, a Gaia OS DynamicCLI privilege-escalation flaw rated CVSS 7.8, to run commands as root. Check Point has separately acknowledged a small number of real-world exploitation cases in its security advisory. The issue is not a standalone remote-entry vulnerability; attackers needed the earlier foothold. This is separate from a previous Check Point management-server root-execution flaw and a different VPN authentication bypass reported earlier by Abijita.
With root access, attackers installed PHP webshells and the TSGA backdoor, which carries the TSProxy component for concealed network connections. They used a scanner to locate internal systems, connected to VMware ESXi hosts over SSH through the vpxuser service account and deployed the destroy_v6 wiper. Check Point said some targets in the first wave experienced destructive activity, but it found no evidence of data destruction in the broader second wave.
Check Point Research said TSGA and TSProxy share code, configuration and cryptographic material with the PhiliKit framework, which ESET has associated with the China-nexus cluster UNC5221. The researchers did not attribute the campaign to a specific actor, saying the evidence also leaves room for an initial-access broker or a false-flag operation.
Check Point’s advisory for CVE-2026-123039 identifies the affected Gaia branches and directs administrators to install the applicable Jumbo Hotfix Accumulator update. The campaign also relied on the PHP2Shell flaws, which form a separate part of the attack chain.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
