Attackers exploited PHP2Shell vulnerabilities in Check Point gateways, then moved into victims’ networks and deployed a wiper on a VMware ESXi host, Check Point reported in coverage published by SecurityWeek on November 13. A destructive wave targeting Israeli organizations began on October 30, followed by a broader international wave on November 2.
The campaign affects organizations running Check Point gateways, with Mobile Access gateways targeted in the first wave. Check Point observed no clear preference for a particular sector in either wave, describing the targeting as opportunistic attempts to gain initial access.
PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution—running attacker-controlled code on a vulnerable system—and affect all PHP versions from PHP 5 onward. Patches were released on October 21. Exploitation began days before those patches, with mass exploitation following shortly afterward.
From gateway access to destructive activity
Check Point said the attackers used PHP2Shell to enter the gateways, then exploited CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI process. That second step gave them root access, the highest level of control on the system, allowing them to deploy PHP webshells and maintain access.
In the late-October attacks against multiple Israeli organizations, the intruders placed those webshells—scripts that accept remote commands—in a directory used by the Mobile Access portal to construct login pages. This gave them a way to issue commands and strengthen their foothold.
They then deployed TSGA and TSProxy for backdoor access and interception of network functions. Both are variants of the PhiliKit malware framework, previously seen in attacks on Ivanti products by the China-linked group UNC5221.
After discovering internal assets, the attackers moved laterally to a VMware ESXi host, deployed and executed a wiper, and left a note mentioning Dream Security. A wiper is malware designed to destroy data.
China-linked clues leave attribution uncertain
SecurityWeek also reported that Dream had linked PHP2Shell attacks used to obtain root access on Palo Alto Networks firewalls to Chinese hackers. In the Check Point campaign, investigators identified China-linked malware and infrastructure, alongside activity during typical Chinese working hours.
Check Point nevertheless said attribution remained uncertain because the destructive activity did not align with known Chinese cyber operations. It considered several possibilities: the identified actor conducted the entire campaign, acted only as an initial-access broker supplying entry to another attacker, or participated in a false-flag operation intended to mislead investigators. The destruction could also have served as a smoke screen.
The second wave, beginning November 2, expanded to Check Point Security Gateways at organizations across multiple countries, including some Israeli entities targeted in the first wave. Check Point observed no destructive activity during that wave.
