Unpatched Check Point gateways wiped after PHP2Shell exploitation
Original title: Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell
Two late-October waves used three CVEs for root, webshells and, in Israel, a Linux wiper.
From October 30, an attacker scanned unpatched Check Point Security Gateways and entered through the Mobile Access portal with PHP2Shell, tied to CVE-2026-109618 and CVE-2026-109619. CVE-2026-123039 in DynamicCLI then gave root, followed by PHP webshells, the TSGA backdoor and TSProxy. The first wave hit Israeli organizations and sometimes ran the destroy_v6 wiper; a November 2 wave reached more countries without destruction. Check Point links the tools to PhiliKit and possibly UNC5221 but says confidence is not high.
Unconfirmed: Check Point cannot say with high confidence whether UNC5221 ran the campaign, supplied access, or planted misleading clues.
- Activity came from 130.94.19[.]204 about a week after a fix was available.
- Session files under /opt/CPcvpn-R81.20/tmp/ carried the marker upload_progress_pwn.
- Webshell names started with zz and ended in .tpl.
- The wiper left DREAM_ANNEXATION.txt and rejected ransom talks.
- Shared PhiliKit traits include TCP port 11072 and socket /tmp/.p_sock.
Impact: root control, persistent backdoors, and destructive file wiping
| Product | Affected |
|---|---|
| Check Point Security Gateways | unpatched Mobile Access portals |
- 1.Apply the available Check Point security fix on unpatched Security Gateways.
- 2.Hunt for upload_progress_pwn session files and zz*.tpl webshells.
- 3.Check for TSGA, slot_CPconfigdaemon, and TSProxy at /lib/libcpfwcommon.so.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1485 Data DestructionT1021.004 Remote Services: SSH
- Vendors
- Check Point
- Threat actors
- UNC5221
- Organizations
- Check Point ResearchESET
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 130.94.19.204 | a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile |
From the original article
4 min read at securityaffairs.com
Unpatched Check Point gateways were hacked worldwide, leading to root access, backdoors, network intrusion and destructive wiper attacks. Starting on 30 October, an attacker scanned and exploited Check Point Security Gateways that hadn’t been patched, going in through the Mobile Access portal. Check Point Research describes the activity as PHP2Shell for initial access, followed by […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.