PHP2Shell Exploitation on Check Point Gateway

Key findings

• Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with unpatched Check Point Security Gateways, using Mobile Access portals with PHP2Shell as initial access followed by CVE-2026-123039.
• The first wave, on October 30, targeted Israeli organizations and included destructive activity against some of them. A broader second wave on November 2 targeted organizations across multiple countries and sectors, with no evidence of destructive activity
• In the investigated intrusion, PHP2Shell provided initial access, followed by privilege escalation through the DynamicCLI interface, tracked as CVE-2026-123039. The attackers then deployed PHP webshells, the persistent TSGA backdoor and its embedded TSProxy networking component.
• The attackers pivoted from the gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed DREAM_ANNEXATION.txt notes during the destructive stage.
• TSGA and TSProxy are modified variants of PhiliKit, a malware framework previously documented in attacks exploiting Ivanti vulnerabilities. Both tools share distinctive code, configuration, and cryptographic material with the framework
• Although ESET associated PhiliKit with China nexus UNC5221, the evidence does not allow us to assess with high confidence the true nature of this operation. Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation. It is also possible that the destructive activity served as a smoke screen.
• The note left during the destructive activity uses the Dream Security brand. Dream had recently published research on PHP2Shell exploitation of Palo Alto Networks devices by China nexus actors. While this timing raises the possibility of retaliation, the available evidence does not establish a clear motive.

Introduction

We have now confirmed that, in late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways. Evidence suggested some cases of a successful compromise, with exploitation activity consistent with PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619.

Following initial access, the attacker escalated privileges from the portal service account to root by exploiting CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface. The attacker then used privileged command execution to deploy PHP webshells and establish persistence.

A second scanning wave on November 2^nd targeted some Israeli organizations previously targeted during the first wave, alongside additional organizations worldwide, with no apparent focus on Israel. Neither wave showed a clear sector preference, suggesting opportunistic initial-access attempts rather than sector-specific targeting.

Infection Flow

On October 30, 2026, the first signs of exploitation appeared on the targeted Check Point Mobile Access gateways. PHP session artifacts were created under /opt/CPcvpn-R81.20/tmp/, including session files containing the upload_progress_pwn marker associated with the exploitation activity. During the same window, the portal’s Apache/PHP workers experienced hundreds of segmentation faults, providing additional evidence of repeated exploitation attempts against the service.

After gaining access to the Mobile Access portal, the attackers escalated privileges to root by exploiting CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI interface. With privileged command execution, the attackers placed PHP webshells in , a directory used by the Mobile Access portal to construct its login pages. These webshells provide a way to send commands through the web portal, establishing a stronger foothold within the compromised environment.

printf  | base64 -d > /zz.tpl

The attacker used multiple .tpl files with names matching the pattern zz*.tpl Each initially received a small command-execution shell, which was then replaced with a more capable version. The expanded shell requires the hardcoded key zz2026 and supports operating-system commands, PHP code execution, and file uploads. Uploaded files are saved to the fixed path /tmp/.up.tpl. The attackers subsequently issued commands to copy that file into the portal’s directory as challenge_render.tpl.

The attackers then moved from web-based access to a standalone passive backdoor, launching the TSGA malware (/tmp/CPconfigdaemon) in the background and redirecting its output to a hidden temporary log:

nohup /tmp/CPconfigdaemon >/tmp/.bd.log 2>&1 & printf started

When executed as root, the malware relocates itself and relaunches under the name slot_CPconfigdaemon in the boot persistence directory. The executable also carries a second component, TSProxy: an embedded shared library that it writes to /lib/libcpfwcommon.so. Its injection code loads this library into selected appliance processes, where it intercepts networking functions to handle specially marked attacker connections while allowing ordinary traffic to continue. This combines a persistent standalone backdoor with concealed access through existing appliance services.

The attackers then deployed the gogo scanner on the gateway to discover internal assets and services across the network and continued to move laterally to a VMware ESXi host over SSH, authenticating with the vpxuser service account. On the ESXi host, they staged the destroy_v6 wiper to /tmp/des wiper and executed it. Finally, the attackers left a note that accompanied the destructive activity named DREAM_ANNEXATION.txt.

Technical Analysis

Webshells

The expanded PHP webshell requires a hardcoded key to access its command-execution, PHP-evaluation, and file-upload functions. It supports both plain-text and Base64-encoded, XOR-obfuscated commands, and saves uploaded files to /tmp/.up.tpl.

Wiper

The Linux ELF wiper destroy_v6 accepts a target directory as a command-line argument. The optional -f flag enables fast deletion, while -w specifies a pipe-separated list of directories to exclude. The wiper recursively traverses the target directory, deleting files regardless of extension and skipping excluded subtrees. By default, it attempts to overwrite files with zeros before deleting them, fast mode skips the overwrite step. It also writes DREAM_ANNEXATION.txt to each processed directory. This politically themed note includes a timestamp and explicitly rejects ransom negotiations.

TSGA – slot_CPconfigdaemon

The TSGA implant, deployed as slot_CPconfigdaemon, is a Linux gateway implant with substantial Check Point-specific functionality. It provides encrypted remote access, configuration theft, backup and snapshot persistence, process injection, and binary firewall-log tampering.

TSProxy

TSProxy is a Linux shared-library backdoor embedded in TSGA and dropped as /lib/libcpfwcommon.so and supports encrypted SOCKS-style proxying.

Tools relationship

Both TSGA and TSProxy are Check Point-specific components linked to the previously reported PhiliKit-associated toolset. PhiliKit is a passive backdoor and installer targeting Ivanti VPN appliances and was previously reported following the February 25, 2026 upload of a sample named philistine to VirusTotal.

TSGA and the PhiliKit implant have roots in Tiny SHell, and share a core set of remote-control capabilities. Both implement authenticated, encrypted communications through TCP port 11072 and the Unix socket /tmp/.p_sock. The analyzed PhiliKit build restricts its TCP listener to loopback, whereas TSGA listens on all IPv4 interfaces. Both provide interactive shells with pseudo-terminal allocation, configurable terminal dimensions and bidirectional input/output. Operators can execute arbitrary shell commands and Python or Perl scripts, retrieve their output, transfer files using operator-selected paths, and collect selected or full appliance configurations over the encrypted channel.

TSProxy shares distinctive configuration with libdssafe.so, the networking component embedded in PhiliKit package: identical operator credentials, transport secrets, three matching activation-selector digests, and the same TLS certificate and private key. These overlaps strongly support a shared tooling lineage.

Attribution

The implants delivered to the gateway, TSGA and TSProxy are part of the PhiliKit malware family, which has been associated with the China-nexus group UNC5221 and previous exploitation of Ivanti appliances. In addition, gogo scanner has also been reported in connection with Chinese-nexus threat actors exploiting Ivanti vulnerabilities.

The infrastructure IP addresses used by the attacker were hosted on LightNode VPS infrastructure, a service previously associated with activity by Chinese- nexus threat actors.

The scanning activity was concentrated between 00:00 and 09:00 UTC, corresponding to 08:00–17:00 in China and broadly aligning with typical Chinese working hours.

With all the above, the following attributes that appeared in the described campaign do not appear to fully align with known Chinese-nexus groups (and specifically UNC5221) motives and interests:

• Destructive operation
• Focus on Israel and wiper note in Hebrew referring to the Israeli-Palestine conflict
• Philikit name derived from the malware internal name philistine

Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation. Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation. It is also possible that the destructive activity served as a smoke screen.

IOCs