Check Point gateways exploited via PHP2Shell to wipe ESXi hosts
Original title: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Attackers chained two PHP RCEs with gateway zero-day CVE-2026-123039, then ran the destroy_v6 wiper.
Check Point says attackers hit Security Gateway Mobile Access portals with PHP2Shell, then used zero-day CVE-2026-123039 for root, planted PHP webshells and the TSGA backdoor, and on some paths wiped VMware ESXi data. The first wave began October 30 against Israeli organizations; a November 2 wave hit other countries and sectors without the wiper. PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, fixed by PHP on October 21 and added to CISA’s KEV catalog on October 26. Check Point urges the November Jumbo Hotfix.
Unconfirmed: Attribution to UNC5221 is not confident, and political notes may be a false flag.
- PHP2Shell is unauthenticated remote code execution; Amazon saw attempts before the October 21 patches.
- The wiper, destroy_v6, zero-fills then deletes; a note rejects ransom.
- Check Point only tentatively links TSGA and TSProxy to PhiliKit and UNC5221.
- Customers should install the November Jumbo Hotfix on Management Servers and gateways.
Impact: root on gateways, webshells, and ESXi data wiped
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | emergency patches on October 21 |
| Check Point Security Gateway | — | November Jumbo Hotfix |
- 1.Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals.
- 2.Check for upload_progress_pwn session files, unexpected CPconfigdaemon processes, and unexplained firewall log gaps.
- 3.Look for unauthorized SSH from the gateway to internal VMware ESXi hosts.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1485 Data DestructionT1046 Network Service Discovery
- Vendors
- Check PointPHPVMware
- Products
- Security GatewayVMware ESXi
- Threat actors
- UNC5221
- Organizations
- CISAAmazon Threat IntelligenceESET
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.