Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

Unpatched Check Point gateways hit with PHP2Shell and a wiper

Original title: PHP2Shell Exploitation on Check Point Gateway

Check Point Research ()6 min read1
Read at research.checkpoint.com
Part of a story covered by 3 sourcesPHP2Shell hits unpatched Check Point gateways; scanner followsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

After a late-October fix, attackers used PHP2Shell then CVE-2026-123039, deployed TSGA, and wiped some Israeli ESXi hosts.

Check Point Research says scanning from 130.94.19[.]204 began on October 30, 2026, about a week after a fix, against unpatched Security Gateways with Mobile Access portals. PHP2Shell, linked to CVE-2026-109618 and CVE-2026-109619, gave initial access; CVE-2026-123039 in DynamicCLI then escalated the portal account to root. Attackers planted PHP webshells, the TSGA backdoor and embedded TSProxy, both modified PhiliKit variants, scanned internally, and moved over SSH to VMware ESXi as vpxuser. On some Israeli victims they ran destroy_v6 and left DREAM_ANNEXATION.txt. A November 2 wave was broader and showed no destructive activity. Check Point does not attribute the operation with high confidence.

Unconfirmed: Check Point says attribution is not high confidence and several scenarios, including a false flag or access broker, remain plausible.

Key facts
  • Session files under /opt/CPcvpn-R81.20/tmp/ contained the upload_progress_pwn marker.
  • Webshells used key zz2026; uploads landed at /tmp/.up.tpl then challenge_render.tpl.
  • TSGA relaunches as slot_CPconfigdaemon and writes TSProxy to /lib/libcpfwcommon.so.
  • ESET previously tied PhiliKit to UNC5221, but Check Point will not confirm that link here.
Security assessment · AI, from the articleExploited in the wild

Impact: Root on the gateway, persistence, lateral movement and ESXi wiping

ProductAffected
Check Point Security Gateway Mobile Accessunpatched gateways, path references CPcvpn-R81.20
What to do
  1. 1.Patch Check Point Security Gateways, including Mobile Access portals, that remain unpatched.
  2. 2.Hunt for zz*.tpl webshells, /tmp/CPconfigdaemon, slot_CPconfigdaemon and /lib/libcpfwcommon.so.
  3. 3.Review SSH use of the ESXi vpxuser account and look for destroy_v6 and DREAM_ANNEXATION.txt.
Analyze CVE-2026-123039 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-123039CVE-2026-109618CVE-2026-109619
ATT&CK
T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSHT1485 Data Destruction
Tags
check-pointphp2shellwebshellwiperesxiphilikit
Vendors
Check Point
Products
Security GatewayMobile AccessVMware ESXi
Threat actors
UNC5221
Malware
TSGATSProxyPhiliKitdestroy_v6
Organizations
Check Point ResearchESET
Countries
Israel

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-123039
Local root command execution via Gaia OS DynamicCLI socket
7.8—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv4130.94.19.168bde8ecb45b7a243a30ceadf26654da libdssafe.so 130.94.19[.]204 130.94.19[.]168
ipv4130.94.19.204a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile
sha2560522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f738a1128442056a242de086996add8cb49cd6496c36003237 destory_v6 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7 DREAM_ANNEXATION.txt ee16e1695711b9d60c62925fcfb2fe1a29c18a
sha2563b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db904ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63 CPconfigdaemon 3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 gogo c7d9477309fac6c638a1128442056a242de086996add8cb49cd649
sha2564171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec809edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 tpl webshell 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 slot_CPconfigdaemon d7549671c7189979f0624ec52dad9ea6a707d23
sha256c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c360032379023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 gogo c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237 destory_v6 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaf
sha256d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 slot_CPconfigdaemon d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63 CPconfigdaemon 3b51080a909023f7d484e2443740b572307ce0054eb9
sha256edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3ructive activity served as a smoke screen. IOCs sha256 name edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 tpl webshell 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9
sha256ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d739e5f5f8ceb9742c980aaff1cfc9515f3a96f7 DREAM_ANNEXATION.txt ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 philistine fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a24
sha256fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da0c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 philistine fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da libdssafe.so 130.94.19[.]204 130.94.19[.]168

From the original article

6 min read at research.checkpoint.com

Key findings Introduction We have now confirmed that, in late October 2026, approximately one week after a security fix became available, activity originating from 130. 94. 19[.]

Check Point Research

research.checkpoint.com

Read the full article at Check Point Research

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.