PHP2Shell exploited in destructive Check Point gateway attacks
Original title: PHP2Shell Exploited in Destructive Check Point Gateway Attacks
Waves from October 30 and November 2 used two PHP RCE flaws and a DynamicCLI bug to reach root and deploy a wiper.
Check Point says attackers exploited PHP2Shell, CVE-2026-109618 and CVE-2026-109619, for initial access to Check Point gateways, then CVE-2026-123039 in DynamicCLI for root. They planted PHP webshells on Mobile Access portals, deployed TSGA and TSProxy, and in the first wave wiped a VMware ESXi host. PHP patches landed on October 21, but exploitation began days earlier. Neither wave showed a clear sector preference.
Unconfirmed: Check Point says it cannot assess with high confidence whether this was the named actor, an access broker, a false flag, or a smokescreen.
- The first wave began October 30 and targeted Israeli organizations.
- A second wave from November 2 hit gateways worldwide and was not destructive.
- Attackers used CVE-2026-123039 in DynamicCLI to gain root and plant PHP webshells.
- They deployed TSGA and TSProxy, PhiliKit variants, then wiped a VMware ESXi host.
- Activity matched typical Chinese working hours, but Check Point will not attribute it.
Impact: Remote code execution, root access, webshells, and data wiping
| Product | Affected |
|---|---|
| PHP | all PHP versions from PHP 5 onwards |
| Check Point Gateway | — |
| Check Point DynamicCLI | — |
- 1.Apply the October 21 PHP patches for CVE-2026-109618 and CVE-2026-109619.
- 2.Check Check Point Mobile Access portals for unexpected PHP webshells.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1485 Data Destruction
- Vendors
- Check Point
- Organizations
- Dream Security
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
2 min read at securityweek.com
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. The post PHP2Shell Exploited in Destructive Check Point Gateway Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.