Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Check Point Software has revealed that unpatched instances of its Security Gateways were compromised by exploiting PHP2Shell vulnerabilities, allowing attackers to gain root access and deploy a data-wiping malware on VMware ESXi hosts. The attacks, which began on October 30, 2026, initially targeted Israeli organizations before expanding globally in early November.

The attack chain began with the exploitation of PHP2Shell vulnerabilities, which are critical flaws allowing unauthenticated remote code execution on vulnerable systems. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were patched by PHP in late October, but exploitation attempts reportedly began before the patches were available. By leveraging these vulnerabilities, attackers gained initial access through Check Point's Mobile Access portal, a component of the Security Gateway.

Once inside, the attackers used a newly disclosed local privilege escalation flaw, CVE-2026-123039, to elevate privileges to root. This flaw exists in the DynamicCLI interface of Check Point's Gaia OS, allowing any authenticated local user to execute arbitrary commands with root privileges. The attackers utilized this access to install PHP web shells and the TSGA backdoor, which includes a networking component called TSProxy. These tools enabled persistent access and concealed command and control activities within normal network traffic.

The attackers then moved laterally to VMware ESXi hosts, where they deployed a data wiper known as destroy_v6. This malware recursively deletes data, making recovery difficult by overwriting files. The presence of politically themed notes, such as DREAM_ANNEXATION.txt, left on compromised systems suggests a potential false-flag operation. However, Check Point has not confirmed the identity of the threat actors, noting that the evidence does not conclusively link the campaign to any known group, including those with a China nexus.

Check Point's products affected by these attacks include various versions of their Firewall, Multi-Domain Security Management Server, Scalable Platforms, and Security Management Server. The company has released emergency hotfixes to address the exploited vulnerabilities and advises customers to prioritize updating systems with internet-facing Mobile Access portals. Additionally, administrators should check for indicators of compromise, such as unauthorized SSH activity and unexpected processes, to identify potentially breached systems.

Privilege escalation vulnerabilities like CVE-2026-123039 are particularly dangerous because they allow attackers who have already gained a foothold in a system to escalate their privileges, often to the highest level of access. This can enable them to execute further malicious actions, maintain persistence, and evade detection. Organizations must regularly update their systems and apply security patches promptly to mitigate the risks posed by such vulnerabilities.