Check Point PHP2Shell flaws exploited for root and ESXi wiper
Original title: Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware
CVE-2026-123039 on Gaia OS R81 through R82.20 followed PHP2Shell entry; named Jumbo Hotfix Takes are the fixes.
Attackers exploited PHP2Shell remote code execution, tracked as CVE-2026-109618 and CVE-2026-109619, on unpatched Check Point Mobile Access portals, then used local flaw CVE-2026-123039 (CVSS 7.8) for root. Activity started October 30, 2026, against Israeli organizations, with a broader wave from November 2 and no destruction in that phase. Intruders planted PHP webshells, TSGA and TSProxy (modified PhiliKit), scanned internally, and on at least one path SSH'd to VMware ESXi as vpxuser and ran the destroy_v6 wiper. Spark Firewalls and Smart-1 Cloud are not affected.
Unconfirmed: UNC5221 overlap is suspected, but attribution is unsettled because the destructive Israel-focused activity does not match that group's usual motives.
- Check Point reports CVE-2026-123039 exploitation against several dozen customers.
- Fixed Jumbo Hotfix Accumulators are R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174.
- The wiper leaves DREAM_ANNEXATION.txt and is not described as ransom-driven.
- Activity was traced to 130.94.19[.]204 about a week after a fix was available.
Impact: Root on gateways and file wipe on ESXi hosts
| Product | Affected | Fixed in |
|---|---|---|
| Check Point Gaia OS firewalls, management and log servers, Multi-Domain servers, and Maestro Orchestrator | R81 through R82.20 | R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 |
- 1.Install the named Jumbo Hotfix Accumulator takes for the running release.
- 2.As a stopgap, disable dynamic_server with dbset and dbset :save.
- 3.Hunt dynamicCli.log for non-Clish commands and confirm /tmp/dynamic_socket is 0660.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 Remote Services: SSHT1485 Data Destruction
- Vendors
- Check PointVMware
- Threat actors
- UNC5221
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 130.94.19.168 | libdssafe.so IP 130.94.19[.]204 Attacker infrastructure IP 130.94.19[.]168 Attacker infrastructure Note: IP addresses and domains ar |
| ipv4 | 130.94.19.204 | pecific sectors. The activity traced back to the IP address 130.94.19[.]204 began approximately one week after a security fix was mad |
| sha256 | 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7 | 442056a242de086996add8cb49cd6496c36003237 destroy_v6 SHA256 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7 DREAM_ANNEXATION.txt SHA256 ee16e1695711b9d60c62925fcfb2fe1 |
| sha256 | 3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 | d9ea6a707d23146e3585ab8f8c4720eca0c63 CPconfigdaemon SHA256 3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 gogo SHA256 c7d9477309fac6c638a1128442056a242de086996add8cb |
| sha256 | 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 | b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 tpl webshell SHA256 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 slot_CPconfigdaemon SHA256 d7549671c7189979f0624ec52dad9ea6 |
| sha256 | c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237 | 484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 gogo SHA256 c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237 destroy_v6 SHA256 0522937c0c0337be54fe25493539e5f5f8ceb9742 |
| sha256 | d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63 | f9a6e0ab6096c9144072bf46b37a2ec8 slot_CPconfigdaemon SHA256 d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63 CPconfigdaemon SHA256 3b51080a909023f7d484e2443740b572307ce |
| sha256 | edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 | patch quickly. Ioc Type Indicator Name / Description SHA256 edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 tpl webshell SHA256 4171b521fa6441382aa2fa014a08e18ff9a6e0a |
| sha256 | ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 | 8ceb9742c980aaff1cfc9515f3a96f7 DREAM_ANNEXATION.txt SHA256 ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 philistine SHA256 fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb |
| sha256 | fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da | fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 philistine SHA256 fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da libdssafe.so IP 130.94.19[.]204 Attacker infrastructure IP |
From the original article
3 min read at gbhackers.com
Attackers are exploiting a remote code execution vulnerability in PHP2Shell, combined with a newly disclosed local privilege escalation flaw, to take over unpatched Check Point Security Gateways. This lets them gain root access and, in some cases, wipe VMware ESXi hosts. Check Point has reported active exploitation of the second flaw, identified as CVE-2026-123039, affecting […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.