UNC5221

PHP2Shell Vulnerabilities Exploited in Destructive Check Point Gateway Attacks

Threat actors exploited two critical PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to compromise Check Point Gateway appliances and deploy a wiper in targeted organizations. The campaign unfolded in two waves, beginning with destructive attacks on Israeli entities on October 30 followed by a broader wave starting November 2. Attackers used the flaws for initial remote code execution, then escalated privileges via CVE-2026-123039 in the DynamicCLI process to install PHP webshells and PhiliKit-based backdoors TSGA and TSProxy. Lateral movement led to VMware ESXi hosts where wipers were executed and a note referencing Dream Security was left. While infrastructure and malware overlap with China-linked UNC5221 activity, the destructive wiper use deviates from typical nation-state patterns, leaving attribution uncertain. Check Point notes the operators worked during Chinese business hours yet no clear sector targeting was observed.