Unidentified actor chains PHP2Shell flaws with Gaia OS bug to wipe ESXi files

An unidentified threat actor exploited unpatched Check Point Security Gateways beginning Oct. 30, 2026, chaining PHP2Shell initial access with a Gaia OS privilege escalation to install the TSGA backdoor and wipe files on VMware ESXi hosts, a new development in the campaign against Israeli organizations that Check Point disclosed.

Initial access came through the Mobile Access portal via the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. After gaining entry through the portal service account, the attackers deployed PHP web shells supporting command execution and file upload to establish persistent access.

The attackers then used CVE-2026-123039 to raise privileges to root through the DynamicCLI interface. The flaw carries CVSS score 7.8 and is a missing authorization issue in the DynamicCLI process that lets an authenticated local user execute arbitrary commands as root. Check Point said, “The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes.”

Check Point observed active exploitation of CVE-2026-123039 against a couple of dozen customers. From the compromised gateway the attackers shifted to a VMware ESXi host through SSH, logging in with the vpxuser service account. They staged and executed a Linux ELF wiper called destroy_v6 that recursively traverses target directories, deletes all files regardless of extension, and attempts to overwrite files with zeros before deletion. They dropped a note named DREAM_ANNEXATION.txt in each processed directory during the destructive stage.

The attackers deployed TSGA as slot_CPconfigdaemon, a Linux gateway implant offering encrypted remote access, theft of configuration, persistence through backups and snapshots, process injection, and tampering with binary firewall logs, together with an embedded TSProxy networking component. Check Point said, “This combines a persistent standalone backdoor with concealed access through existing appliance services.” TSProxy loads a library into selected appliance processes to intercept networking functions, handle specially marked attacker connections, and let ordinary traffic continue.

The attackers deployed the gogo scanner on the gateway to find internal assets and services across the network. Some organizations singled out in the first wave also experienced destructive actions including wiper malware deployment. Activity traced to IP address 130.94.19[.]204 hit Israeli organizations via vulnerable Mobile Access portals on Check Point Security Gateways in late October 2026, roughly one week after a security fix became available.

Check Point said the intrusions began with attacks on Israeli organizations, followed by a broader wave on Nov. 2, 2026, hitting organizations across countries and sectors. The November 2 wave included some Israeli organizations already hit in the first wave plus other organizations worldwide, without a specific geographic or sector preference, indicating opportunistic initial access.

ESET documented the PhiliKit toolkit in June 2026 and attributed it to the China-nexus cyber espionage group Armory Castle, formerly UNC5221. Check Point assesses TSGA and TSProxy as Check Point-specific components of that toolkit.

Check Point said it lacks enough evidence to link the campaign to the threat actor or other known Chinese-nexus groups, citing wiper malware use and Israeli-Palestine conflict references in the wiper note. Scenarios remain plausible, including that the actor ran the whole campaign, served only as an initial access broker, took part in a false-flag operation, or that the wiping was a smoke screen. Factors pointing to China alignment include the use of LightNode VPS infrastructure and scanning concentrated between 12 and nine a.m. UTC, matching Chinese working hours.

The flaw affects versions R82.20, R82.10, R82, R81.20, R81.10, and R81 of Check Point Force Firewalls, Check Point Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator. Check Point Software’s vulnerable product list also includes Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server.

Check Point Software released emergency hotfixes to address the high-severity CVE-2026-123039 flaw. For teams that cannot deploy the hotfixes right away, Check Point recommended halting dynamic_server and blocking its restart as a short-term mitigation step. The vendor shared indicators of compromise and said customers can look for commands associated with exploitation attempts, use of the system() sink uncommon in legitimate traffic, and commands not using the default Clish wrapper, which indicates execution as root through the socket.

Earlier in September, Check Point warned that attackers exploited zero-day remote code execution flaws CVE-2026-93616 on Security Management Server and CVE-2026-85102 on Security Gateway without requiring privileges on the targeted systems. CISA added five Check Point flaws to its actively exploited vulnerabilities catalog over the last two years, and two of those flaws were also abused by ransomware gangs.