Threat actors have been exploiting PHP2Shell vulnerabilities to hack Check Point Gateway appliances and deploy a wiper against victim organizations, Check Point reports.
The attacks unfolded in two waves. An initial, destructive round started on October 30 and targeted Israeli organizations, and a second one started on November 2, targeting organizations across multiple countries.
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, refers to two critical vulnerabilities leading to remote code execution (RCE) and affecting all PHP versions from PHP 5 onwards. They were patched on October 21, but exploitation started days before patches and mass exploitation shortly after.
As part of the Check Point campaign, the attackers exploited PHP2Shell for initial access, then targeted CVE-2026-123039, a local privilege escalation in the DynamicCLI process, to gain root access and deploy PHP webshells and establish persistence.
In late October, the attackers targeted Check Point Mobile Access gateways across multiple Israeli organizations. They placed PHP webshells in a directory the Mobile Access portal uses to construct login pages, allowing them to send commands and establish a stronger foothold on the environment.
Next, they deployed TSGA and TSProxy, variants of the malware framework PhiliKit previously seen in China-linked UNC5221’s hacking into Ivanti products, for backdoor access and network function interception.
The attackers followed up with internal asset discovery, then moved laterally to a VMware ESXi host where they deployed and executed a wiper, and then deployed a note mentioning Dream Security.
According to Check Point, the hackers operated during typical Chinese working hours. Despite this and the use of China-linked malware and infrastructure, the use of a wiper and the destructive nature of the attacks do not align with known Chinese cyber operations.
