Attackers exploit Check Point PHP2Shell flaws to deploy web shells and wipe ESXi files
Attackers have targeted unpatched Check Point Security Gateways since October 30, 2026, using the PHP2Shell vulnerabilities to gain access, escalate privileges and deploy web shells, according to Check Point. The company said a broader wave began on November 2 and affected organizations in multiple countries and sectors. It also reported destructive activity against some victims, including attempts to erase files on VMware ESXi hosts.
The campaign affects Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server installations running versions R82.20, R82.10, R82, R81.20, R81.10 or R81, Check Point said. The PHP2Shell activity involved CVE-2026-109618 and CVE-2026-109619. Check Point said a security fix had been available for about a week when activity from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals.
The attackers first used PHP2Shell for access, then exploited CVE-2026-123039 in the Gaia OS DynamicCLI interface, according to Check Point. The flaw is a missing authorization check that can let an authenticated local user run arbitrary commands by writing a request to a socket. That step requires code execution on the appliance, but Check Point said it had observed active exploitation against a couple of dozen customers.
After gaining root access, the attackers deployed PHP web shells that supported command execution and file uploads, Check Point said. They also installed TSGA, a persistent backdoor, together with its TSProxy networking component. The pair can provide encrypted remote access, steal configuration data, maintain access through backups and snapshots, inject processes and alter firewall logs, according to the company.
Check Point said the attackers scanned internal assets from the gateway and moved to a VMware ESXi host over SSH using the vpxuser service account. They then ran the destroy_v6 wiper, which recursively deletes files and attempts to overwrite them with zeros before deletion. The activity left DREAM_ANNEXATION.txt notes in processed directories.
Check Point linked TSGA and TSProxy to a toolkit called PhiliKit, which ESET documented in June 2026, but said the available evidence does not establish who ran the campaign. The company cited the targeting of Israeli organizations, politically themed wiper notes and infrastructure associated with the activity, while also saying that several explanations remained possible. Operators of the listed Check Point products should confirm that the available security fix is installed and examine the appliances for PHP web shells, TSGA and TSProxy before treating them as clean.