"PHP2Shell provided initial access, followed by privilege escalation through the DynamicCLI interface, tracked as CVE-2026-123039," Check Point said.
CVE-2026-123039 (DynamicCLI) — a local escalation to root
Check Point reported a previously unreported local privilege escalation flaw in Gaia OS, tracked as CVE-2026-123039, with a CVSS score of 7.8. The vulnerability is a missing-authorization flaw in the DynamicCLI process that "could enable privilege escalation to root," allowing any authenticated local user to run arbitrary commands by writing a single request to the socket. Check Point emphasized that the issue "is a local privilege escalation and requires the attacker to already have local code execution on the appliance," and that it "observed an active exploit of this vulnerability against a couple of dozen customers."
The flaw affects multiple Gaia releases — R82.20, R82.10, R82, R81.20, R81.10, and R81 — across a range of Check Point products, including Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Log Server, and Maestro Orchestrator.
PHP2Shell exploitation of Mobile Access portals on Check Point Gateways
According to Check Point, activity began on October 30, 2026, targeting Israeli organizations, and was followed by a broader wave on November 2, 2026, that aimed at organizations in multiple countries and sectors. The initial access vector in the October activity was exploitation of PHP2Shell vulnerabilities against Mobile Access portals on Check Point Security Gateways, associated with CVE-2026-109618 and CVE-2026-109619.
Check Point said the October targeting originated from IP 130.94.19[.]204 and that the campaigns began "approximately one week after a security fix became available." Evidence suggested successful compromises in some cases consistent with PHP2Shell exploitation. The November 2 wave hit some of the same Israeli organizations already affected on October 30 and expanded opportunistically without a clear geographic or sector preference.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTSGA and TSProxy: a gateway-specific backdoor with covert networking
After obtaining initial access and weaponizing the DynamicCLI flaw to escalate privileges, attackers deployed PHP web shells to establish persistence and then installed a standalone passive backdoor named TSGA. Check Point described TSGA as a "Linux gateway implant with Check Point-specific functionality," deployed as slot_CPconfigdaemon, that provides encrypted remote access, configuration theft, backup and snapshot persistence, process injection, and binary firewall-log tampering.
TSGA includes a second component, TSProxy. Check Point said "[TSProxy's] injection code loads this library into selected appliance processes, where it intercepts networking functions to handle specially marked attacker connections while allowing ordinary traffic to continue." In short, the toolkit combined a persistent implant with concealed access routed through existing appliance services.
ESXi lateral movement, the destroy_v6 wiper, and political notes
Post-exploitation activity observed by Check Point included internal discovery and lateral movement. Operators deployed a network scanner named gogo on gateways to find internal assets and services. From the gateway they pivoted to a VMware ESXi host over SSH by authenticating with the vpxuser service account.
On ESXi hosts attackers staged and executed a Linux ELF wiper called destroy_v6. That malware recursively traverses target directories and deletes all files regardless of extension, attempting to overwrite files with zeros before deletion. During the destructive stage, the intruders left politically themed notes named DREAM_ANNEXATION.txt in each processed directory.
PhiliKit links, ESET attribution, and Check Point's restraint
Check Point assessed that TSGA and TSProxy are Check Point–specific components of a toolkit dubbed PhiliKit, which ESET first documented in June 2026 and attributed to a China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). Additional signals—use of LightNode VPS infrastructure and scanning activity concentrated between 12 and 9 a.m. UTC—were noted as consistent with a China-aligned operator's patterns.
At the same time, Check Point explicitly declined to make a high-confidence attribution to that group or to other known Chinese-nexus actors. The company cited several reasons for caution, including the use of wiper malware, the campaign's focus on Israel, and the explicit references to the Israeli–Palestine conflict in the wiper notes. Check Point noted that multiple scenarios remain plausible: the actor identified may have run the full campaign, acted only as an initial-access broker, participated in a false-flag operation, or that the destructive activity served as a smoke screen.
What this means for security teams, policymakers, and affected organizations
- Security teams and technologists: The chain observed — PHP2Shell initial access, DynamicCLI privilege escalation (CVE-2026-123039), web-shell persistence, and deployment of TSGA/TSProxy — highlights the multi-stage nature of the intrusion and the ability to move from gateway compromise to infrastructure destruction (destroy_v6) via ESXi lateral movement.
- Policymakers and regulators: The rapid exploitation "approximately one week after a security fix became available," the targeting of Israeli organizations followed by a global opportunistic wave, and the deployment of politically themed destructive payloads are details that bear on incident response expectations and disclosure timelines.
- Affected enterprises and procurement leaders: The list of impacted Gaia versions and Check Point products in the advisory provides a concrete scope for inventory and remediation prioritization; observed attacker tactics include credential reuse (vpxuser) and covert network interception via appliance process injection.
The campaign documented by Check Point combines opportunistic initial-access techniques with a tailored gateway implant and a destructive endpoint wiper, yet stops short of a single, definitive attribution. The factual record — timing, CVEs, artifacts such as slot_CPconfigdaemon and DREAM_ANNEXATION.txt, and observed use of destroy_v6 — leaves clear technical footprints even as questions about the operators' identity and motives remain unresolved.
