PhiliKit

Threat Actors Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and destroy_v6 Wiper on ESXi Hosts

An unknown threat actor has been targeting unpatched Check Point Security Gateways since October 30, 2026, initially exploiting PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 to gain access via Mobile Access portals. Attackers then leveraged the local privilege escalation flaw CVE-2026-123039 in Gaia OS DynamicCLI to escalate from the portal service account to root and deploy PHP web shells along with the persistent TSGA backdoor and its TSProxy networking component. The campaign first hit Israeli organizations before expanding on November 2, 2026, to targets across multiple countries and sectors without clear geographic focus. In several cases the actors pivoted via SSH to VMware ESXi hosts, deployed the destroy_v6 wiper malware that recursively overwrites and deletes files, and left politically themed DREAM_ANNEXATION.txt notes. TSGA and TSProxy are assessed as Check Point-specific elements of the PhiliKit toolkit previously linked by ESET to the China-nexus group Armory Castle (formerly UNC5221). Check Point notes insufficient evidence to attribute the full operation with high confidence and lists possible scenarios including initial-access brokerage or false-flag activity.

PHP2Shell Vulnerabilities Exploited in Destructive Check Point Gateway Attacks

Threat actors exploited two critical PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to compromise Check Point Gateway appliances and deploy a wiper in targeted organizations. The campaign unfolded in two waves, beginning with destructive attacks on Israeli entities on October 30 followed by a broader wave starting November 2. Attackers used the flaws for initial remote code execution, then escalated privileges via CVE-2026-123039 in the DynamicCLI process to install PHP webshells and PhiliKit-based backdoors TSGA and TSProxy. Lateral movement led to VMware ESXi hosts where wipers were executed and a note referencing Dream Security was left. While infrastructure and malware overlap with China-linked UNC5221 activity, the destructive wiper use deviates from typical nation-state patterns, leaving attribution uncertain. Check Point notes the operators worked during Chinese business hours yet no clear sector targeting was observed.