An unidentified threat actor has been breaking into Check Point Security Gateways through the PHP2Shell flaws, escalating to root with a previously unreported Gaia OS bug and, in at least one wave, destroying files on VMware ESXi hosts. Check Point disclosed the campaign and shipped fixes on November 12.
How Attackers Chained PHP2Shell Into Root Access on Gaia OS
The intrusions began at the Mobile Access portal. The attackers exploited CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell vulnerabilities that were patched on October 21 and added to the CISA Known Exploited Vulnerabilities catalog on October 26, to gain initial access to the gateways.
Check Point said it has seen active exploitation against “a couple of dozen customers.” After getting in, the attackers planted PHP web shells inside the Mobile Access login templates, giving them a persistent foothold on a device that sits at the network edge.
CVE-2026-123039: The Gaia OS Privilege Escalation Flaw
To reach root, the intruders used CVE-2026-123039, a local privilege escalation in Gaia OS that Check Point had not previously reported. The flaw carries a CVSS score of 7.8 and stems from missing authorization in the DynamicCLI process.
Any authenticated local user can run commands as root by writing a single request to a world-writable socket. Because the PHP2Shell foothold already gave the attackers a local presence, the bug closed the gap between a web-shell session and full control of the appliance.
TSGA Backdoor and the ESXi Wiper Attack
With root access, the actor installed TSGA, a passive Linux backdoor that runs under the name slot_CPconfigdaemon. It embeds a component called TSProxy and offers encrypted remote access, configuration theft, log tampering and process injection.
Attribution Clues Point to PhiliKit but Stay Inconclusive
Check Point found that TSGA and TSProxy are variants of PhiliKit, a toolset previously linked to the China-nexus group UNC5221, which was behind attacks on Ivanti products. The activity also took place during typical Chinese working hours.
The destructive element complicates that picture. The use of a wiper does not match known Chinese operations, and Check Point said it does not attribute the campaign with high confidence. It named three plausible explanations: a false flag, an initial-access broker selling access, or a smokescreen for other objectives.
The Destroy_v6 Wiper and DREAM_ANNEXATION.txt Notes
In the first wave, which hit Israeli organizations on October 30, the attackers pivoted over SSH from a compromised gateway to a VMware ESXi host. There they ran a wiper called destroy_v6 and left behind notes named DREAM_ANNEXATION.txt. One report said the note mentioned Dream Security.
A second, broader wave on November 2 reached organizations across several countries and sectors. Check Point observed no destruction in that wave, which it described as opportunistic and global.
Affected Releases and Check Point’s Fixes
The vulnerable releases are R82.20, R82.10, R82, R81.20, R81.10 and R81. Check Point said Spark Firewalls and Smart-1 Cloud are not affected.
Fixes ship in Jumbo Hotfix takes for R82.20, R82.10, R82 and R81.20; for R82.20 the fixed build is Take 14. Check Point has not listed a fixed take for R81.10 or R81. Administrators on those two releases are advised to stop the dynamic_server process, which breaks Dynamic CLI commands as documented in sk144112, and to review /var/log/dynamicCli.log for commands that did not go through the Clish wrapper.
Why Edge Gateway Compromises Carry Lasting Risk
Security gateways terminate remote-access sessions and sit between the internet and internal networks, so root access on one gives an attacker a vantage point that endpoint tools rarely see. TSGA’s design as a passive backdoor suits that position: it waits for inbound connections rather than beaconing out, which leaves little network noise for defenders to spot.
The case also shows how quickly a published flaw can feed a longer chain. The PHP2Shell patches had been available for roughly nine days before the first wave, and CISA had already flagged exploitation. Organizations that left the Mobile Access portal unpatched in that window supplied the entry point for an attack that ended in wiped hypervisor storage.
For R81.10 and R81 customers, the absence of a fixed take means the process-level workaround is the only mitigation Check Point has offered so far, a trade-off that disables Dynamic CLI functionality until a fix arrives.
