PHP2Shell Exploitation on Check Point Gateway

In late October 2026, attackers exploited PHP2Shell vulnerabilities in Check Point Mobile Access portals on Security Gateways, initially targeting Israeli organizations. The attackers gained root privileges, deployed PHP webshells for persistence, installed TSGA malware and TSProxy backdoors, and moved laterally to VMware ESXi infrastructure. The campaign culminated in deploying the destroy_v6 wiper and a politically-themed ransom rejection note. A second wave of scanning targeted organizations worldwide, indicating opportunistic attacks. The toolset is linked to the PhiliKit malware family and possibly Chinese-nexus actors, though attribution is uncertain.

• PHP · PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational InfrastructureExploitedVulnerability2026-10-27
• The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) withoutHighVulnerability2026-11-12
• CVE-2026-123039: checkpoint Quantum Security Gateway · Missing AuthorizationHighVulnerability2026-11-12
• PHP2Shell Exploitation on Check Point GatewayHighVulnerability2026-11-12
• Bundesamt für Sicherheit in der Informationstechnik Amazon · PHP: Mehrere Schwachstellen ermöglichen CodeausführungExploitedVulnerability2026-10-20