Two critical PHP flaws — CVE-2026-109618 and CVE-2026-109619 — were exploited to break into Check Point Security Gateways and, in some attacks, deploy a destructive VMware ESXi wiper, according to researchers at Check Point and telemetry cited by Amazon Threat Intelligence.
Timeline: patches, early scans, and the two waves
PHP issued emergency fixes for the PHP2Shell vulnerabilities on October 21. Amazon Threat Intelligence reported exploitation attempts began four days earlier. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 26 and later warned that attackers were chaining the PHP2Shell bugs with the Fragnesia Linux kernel flaw to escalate to root.
Check Point says the active campaign began on October 30, initially targeting Israeli organizations. A second wave on November 2 affected companies across multiple countries and sectors; Check Point observed that the second wave did not include the destructive wiping activity seen in the first wave, though the follow-on actions taken by the intruders in that second wave remain unclear.
How the attacker moved from Gateway to ESXi and deployed a wiper
According to Check Point’s analysis, the intruder used PHP2Shell to gain unauthenticated remote code execution through the gateways’ Mobile Access portal. They then exploited a newly disclosed privilege-escalation zero-day tracked as CVE-2026-123039 to obtain root on the gateway. With elevated privileges the actor installed PHP webshells and a backdoor named TSGA, which contains a networking component called TSProxy that listens for attacker commands concealed within regular traffic.
In attacks on Israeli organizations the adversary used the gogo scanner, an open-source network reconnaissance tool, to locate VMware ESXi hosts reachable from the breached gateway. The final destructive stage deployed a wiper called destroy_v6 that recursively deletes data in a target directory. The wiper first attempts a zero fill to make recovery more difficult and also supports a fast mode that skips the overwrite step.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPolitical messaging left on targets and uncertainty over attribution
On at least one ESXi host researchers found a note named DREAM_ANNEXATION.txt that references “Dream Security Ltd.” The file contains political messages and explicitly rejects ransom negotiations, which Check Point says indicates the attackers’ stated objective was disruption rather than extortion. Check Point tentatively linked TSGA and TSProxy to PhiliKit, a framework previously seen in attacks on Ivanti appliances that ESET associated with the cluster UNC5221. However, Check Point stressed the attacks could not be attributed with confidence based on the available evidence; the presence of political messaging also raised questions about a possible false-flag operation.
Indicators to hunt for and patching guidance from Check Point
Check Point advised customers to install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing gateways with internet-facing Mobile Access portals. The hotfix addresses both the PHP2Shell flaws and the DynamicCLI privilege-escalation flaw exploited during the campaign.
- Signs of compromise Check Point recommends hunting for: session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, and unexplained gaps in firewall logs.
- Operationally urgent indicators include unauthorized SSH activity from a gateway to internal VMware ESXi hosts — a clear sign of lateral movement from gateway to hypervisor.
How security teams, policymakers, and affected enterprises should respond
Security teams: Prioritize patching Management Servers and any Security Gateways with internet-facing Mobile Access portals and hunt for the IOCs Check Point lists — especially session files named upload_progress_pwn, anomalous CPconfigdaemon activity, and evidence of SSH connections from gateways to ESXi hosts.
Policymakers and regulators: CISA’s inclusion of the PHP2Shell bugs in the KEV catalog and its warning about chaining to the Fragnesia kernel flaw underline the cross-layer risk when web-facing component flaws are combined with kernel-level escapes; that cataloging and public warning serve as the formal steps taken so far.
Affected enterprises and procurement leaders: Enterprises that run Check Point gateways and VMware ESXi should treat the November Jumbo Hotfix as high priority and verify that gateways that were internet-accessible around October 17–30 have been inspected for the listed signs of compromise, since Amazon Threat Intelligence observed exploitation attempts beginning four days before the vendor patch.
The campaign combines rapid exploitation of newly disclosed web-server flaws, kernel-level escalation, and a tailored lateral-movement path from security gateway to hypervisor, capped in some incidents by a wiper that deliberately hinders recovery. The mix of destructive coding, overt political messaging, and tentative links to known toolsets leaves open questions about intent and attribution — but does not change the immediate operational fact: exposed Mobile Access portals and unpatched Management Servers and Gateways remained a high-value path for attackers and should be remediated without delay.
