CVE-2026-123039: Check Point gateways hit via PHP2Shell, then an ESXi wiper

Attackers have used the PHP2Shell flaws to break into Check Point security gateways through their Mobile Access portals, climbed to root with a separate Check Point zero-day, CVE-2026-123039, and then moved on to a VMware ESXi host and ran a data-destroying wiper there. Check Point Research described the campaign on 13 November 2026. It matters because the target was a firewall, a device that sits at the edge of a network and is trusted by everything behind it, and because the end goal looks like destruction rather than ransom.

Key points

• Check Point Research says attackers first exploited PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in the Mobile Access portal of Check Point gateways, then used CVE-2026-123039 to reach root.
• In the first wave, which started on 30 October 2026 against Israeli organisations, the attackers moved over SSH to a VMware ESXi host and ran a wiper called destroy_v6.
• A second, broader wave on 2 November 2026 hit organisations in several countries and sectors; Check Point says it saw no destructive activity in that wave.
• BleepingComputer reports that Check Point's November Jumbo Hotfix covers PHP2Shell and the DynamicCLI privilege escalation; Check Point links the advisory for CVE-2026-123039 as SK1000362.
• Check Point says the evidence does not allow a high-confidence attribution.

What to do

• Who is affected: Check Point Security Gateways, above all those with an internet-facing Mobile Access portal. The research page mentions a CPcvpn-R81.20 path; none of the pages we could read lists the full set of affected versions, so check the vendor advisory for yours.
• Fix: BleepingComputer says to apply the November Jumbo Hotfix to all Management Servers and Security Gateways, starting with gateways whose Mobile Access portal faces the internet. Read SK1000362 for the exact build numbers.
• Check whether you were hit: BleepingComputer lists these signs: PHP session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, unexplained gaps in firewall logs, and SSH from the gateway to internal ESXi hosts. Check Point also lists the file paths /tmp/CPconfigdaemon, /lib/libcpfwcommon.so, /tmp/.up.tpl and /tmp/.p_sock, TCP port 11072, and the IP addresses 130.94.19[.]204 and 130.94.19[.]168. Its report has the file hashes.
• Gateway to ESXi: a gateway that opens SSH sessions to hypervisors is, in BleepingComputer's words, a clear sign of a breach. Review which accounts and networks let a gateway reach your ESXi hosts, and make sure you have offline backups of virtual machines.

What happened

Check Point Research traces the first signs to 30 October 2026. On an affected gateway, PHP session files containing the marker upload_progress_pwn appeared under /opt/CPcvpn-R81.20/tmp/, and the portal's Apache and PHP workers logged hundreds of segmentation faults. Crashes like that are consistent with memory-corruption exploit attempts, though Check Point's write-up as we read it does not say so in those words.

After the initial break-in the attacker escalated to root with CVE-2026-123039, which Check Point describes as a local privilege escalation through the DynamicCLI inter-process interface, from a portal account to root. The attacker then planted PHP webshells and started a backdoor called TSGA. BleepingComputer adds that TSGA embeds a proxy component, TSProxy, so commands can arrive hidden inside ordinary traffic.

From the gateway the attacker ran an open-source scanner called gogo to find other machines, then connected by SSH to a VMware ESXi host using the vpxuser account. There the wiper destroy_v6 ran. It takes a target directory, deletes files recursively whatever their extension, and by default overwrites them with zeros first; a -f option skips the overwriting for speed. In each directory it processed it left a note called DREAM_ANNEXATION.txt with a timestamp. The note rejects ransom negotiation, so the aim looks like damage, not payment.

The second wave, on 2 November 2026, was broader. Check Point says it hit organisations that had been targeted before plus others in different countries and sectors, and reports no destructive activity in it. Check Point gives no victim count, and neither does BleepingComputer.

Background

PHP2Shell is the name for a pair of unauthenticated remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 on the CVSS scale. The Hacker News reported on 28 October that researchers at Dream described them being used against firewall management servers through PHP's session.upload_progress mechanism. In that report the attacker used the FOFA search engine to find about 19,000 internet-facing firewalls with exposed management interfaces, narrowed them to 240 that matched its filters (the U.S., Japan, Taiwan and South Korea, running PHP 8.0.30), and rooted 25 of them. The Hacker News did not name the firewall vendor in that story.

Internet-facing with exposed management19000

Responded with version data5000

Matched the attacker's filters240

Rooted25

How one PHP2Shell operator narrowed its targets, as reported by Dream (firewalls)

	firewalls
Internet-facing with exposed management	19000
Responded with version data	5000
Matched the attacker's filters	240
Rooted	25

Source: The Hacker News, citing Dream

According to BleepingComputer, Amazon Threat Intelligence said exploitation began about four days before PHP released emergency patches on 21 October, and CISA added both PHP flaws to its Known Exploited Vulnerabilities catalogue on 26 October. We have covered the Linux kernel flaw that CISA warned attackers chain with PHP2Shell in our article on Fragnesia (CVE-2026-46300).

How the attack chain fits together

1. Entry: PHP2Shell against the Mobile Access portal, a web component reachable from the internet.
2. Root: CVE-2026-123039 through the DynamicCLI interface, a Check Point flaw.
3. Persistence: PHP webshells and the TSGA backdoor.
4. Spread: the gogo scanner, then SSH to an ESXi host.
5. Damage: the destroy_v6 wiper.

The chain shows why a patch for one component is not enough. The PHP fix alone would not remove the privilege escalation, and the privilege escalation is only reachable once an attacker is on the box.

What it means

For network teams, the important point is the route from a perimeter device to the virtualisation layer. A gateway that can open SSH sessions to hypervisors turns one internet-facing bug into access to every virtual machine on the host. Limiting that path, and keeping backups the hypervisor cannot reach, limits what a wiper can destroy.

For anyone who patched PHP on web servers but did not think of a vendor appliance as running PHP, the lesson is that appliances carry their own copies of common components, and the vendor's hotfix is the only way to update them. Our guide to which vulnerability to patch first explains how a KEV listing should move something to the top of the queue.

Who is behind it

Nobody can say with confidence. Check Point tentatively links the implants to a toolset it calls PhiliKit, which it says has been seen against Ivanti appliances, and BleepingComputer reports that ESET associates PhiliKit with the China-linked cluster UNC5221. But Check Point lists several things that do not fit that profile: destructive activity, the focus on Israel, a Hebrew-language note about the Israeli-Palestinian conflict, and the name "philistine" in the code. It names several possibilities: one actor running everything, an initial access broker handing off to someone else, a false-flag operation, or destruction used as a smokescreen. The note also uses the name of Dream Security, the company that had recently published research on PHP2Shell attacks; Check Point says that timing raises the possibility of retaliation but does not establish a motive.

What we don't know yet

• Which versions are affected and which build contains the fix. The pages we could read name a November Jumbo Hotfix and advisory SK1000362 but do not give build numbers.
• How many organisations were affected. No victim count has been published in the sources we read.
• Who did it, and why. Check Point leaves the question open.
• Whether other gateway models were hit. Reports so far describe the Mobile Access portal.

What to watch next

Watch for Check Point's advisory updates and a full list of fixed builds, for further details from CISA, and for whether the destructive stage shows up in the broader second-wave victims. If you run Check Point gateways with the Mobile Access portal exposed, check for the indicators above today rather than waiting.

Sources

• Check Point Research: PHP2Shell exploitation on a Check Point gateway (primary source)
• BleepingComputer: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
• The Hacker News: PHP2Shell attack roots 25 servers
• CSO Online: PHP2Shell plus Fragnesia, a dangerous new route from web server to root