Threat actors have been exploiting critical vulnerabilities in PHP2Shell to hack Check Point Gateway appliances, deploy a wiper, and compromise organizations worldwide. The attacks unfolded in two waves, targeting Israeli organizations initially and then spreading globally.
The exploitation of PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, allowed hackers to gain remote code execution (RCE) on affected systems. These vulnerabilities affected all PHP versions from 5 onwards and were patched on October 21. However, the attackers managed to exploit them just days before patches became available, and then proceeded to mass-exploit them shortly after.
The attacks against Check Point Gateways have been linked to Chinese hackers, who allegedly left a note mentioning the cybersecurity firm. The hackers used PHP2Shell for initial access, followed by exploitation of CVE-2026-123039, a local privilege escalation in the DynamicCLI process, to gain root access and deploy PHP webshells and establish persistence.
In late October, the attackers targeted Check Point Mobile Access gateways across multiple Israeli organizations, placing PHP webshells in a directory used by the Mobile Access portal. This allowed them to send commands and establish a stronger foothold on the environment. The hackers then deployed TSGA and TSProxy, variants of the malware framework PhiliKit previously seen in China-linked UNC5221’s hacking into Ivanti products.
The attackers followed up with internal asset discovery, laterally moved to a VMware ESXi host where they deployed and executed a wiper, and then deployed a note mentioning Dream Security. According to Check Point, the hackers operated during typical Chinese working hours, but despite this and the use of China-linked malware and infrastructure, the destructive nature of the attacks does not align with known Chinese cyber operations.
The true nature of this operation remains unclear, with several scenarios remaining plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation. It is also possible that the destructive activity served as a smoke screen.
The second wave targeted Check Point Security Gateways across organizations worldwide, including some Israeli entities targeted in the first wave. No destructive activity was observed during this second wave. The lack of sector preference suggests opportunistic initial-access attempts rather than sector-specific targeting.
This incident highlights the importance of timely patching and vigilance against known vulnerabilities. As hackers continue to exploit unpatched systems, organizations must prioritize security updates and implement robust threat detection measures to prevent similar attacks in the future.
Source: SecurityWeek — 2026-11-13