Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

The attacks started on 30 October, initially against Israeli organizations, according to BleepingComputer. Check Point says the first exploitation wave targeted Israeli organizations, while a second wave on 2 November affected companies in multiple countries and sectors. The attacker used PHP2Shell, two PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619, to reach the gateways through the Mobile Access portal, then exploited the zero-day CVE-2026-123039 to gain root privileges.

The attacker installed PHP webshells and the TSGA backdoor, moved to VMware ESXi hosts located with the gogo scanner, and deployed a wiper called destroy_v6 that recursively deletes data in the target directory. Check Point also found a note named DREAM_ANNEXATION.txt that references Dream Security Ltd., contains political messages and rejects ransom negotiations. Check Point tentatively linked TSGA and TSProxy to PhiliKit, but says the attacks could not be attributed with confidence.

Why it matters Administrators running Check Point gateways with internet-facing Mobile Access portals should treat this as a priority: Check Point recommends the November Jumbo Hotfix, which addresses both PHP2Shell and the DynamicCLI privilege escalation flaw, and checking for compromise indicators such as unexpected CPconfigdaemon processes and unauthorized SSH activity from gateways to ESXi hosts. Because the wiper runs on ESXi hosts, any virtualization estate reachable from an exposed gateway is at risk of data loss, and investigators should review gateway logs for unexplained gaps.