Check Point Gateways Turned Against Their Owners: PHP2Shell → TSGA Backdoor → ESXi Wiper — CVE-2026-123039 on CISA KEV

Nation-state linked attackers exploited two PHP2Shell vulnerabilities to enter Check Point gateway Mobile Access portals, escalated to root through a world-writable socket flaw (CVE-2026-123039), planted the TSGA backdoor, and wiped ESXi hosts with a destructive wiper. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13. If your gateway runs Mobile Access, your incident response clock started then.

DataWater Threat Intelligence Desk | Published November 14, 2026 | 11-minute read

Executive Summary

The firewall that was supposed to protect your network became the first machine the attackers owned.

Beginning in late October 2026, a threat actor exploited two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting Check Point gateways running the Mobile Access portal feature. PHP2Shell gave the attackers unauthenticated code execution on the portal service. From that foothold, they escalated to full Gaia OS root access by sending a command to /tmp/dynamic_socket — a socket that the dynamic_server daemon, running as root, services without asking any caller to prove who it is. CVE-2026-123039 describes that flaw; it carries a CVSS score of 7.8, a High rating, and was placed on CISA’s Known Exploited Vulnerabilities catalog on November 13, 2026.

With root on the gateway, attackers planted web shells in the Mobile Access portal’s login page templates and installed the TSGA backdoor, a passive implant that disguises itself as the legitimate process slot_CPconfigdaemon. The companion library TSProxy was injected into existing appliance processes to handle attacker connections that arrive with a special marking in the traffic. Together, the two tools provided persistent, encrypted remote access that survived gateway reboots and snapshot operations. TSGA also copied the firewall configuration and tampered with binary firewall logs.

In the final phase, attackers pivoted over SSH to a VMware ESXi host using the vpxuser account, deployed the destroy_v6 wiper, and left a file called DREAM_ANNEXATION.txt in each directory the wiper processed. The note contains politically themed content referencing the Israeli-Palestinian conflict. Whether that reflects the attackers’ actual motivation or is designed to obscure attribution is unknown; Check Point calls a false-flag operation one of several plausible scenarios. ESET linked the PhiliKit toolkit to the China-nexus group Armory Castle (formerly tracked as UNC5221) in June 2026, citing LightNode VPS infrastructure and working-hours patterns consistent with a Chinese time zone.

Two attack waves have been confirmed: October 30 (primarily Israeli organizations) and November 2 (broader campaign spanning multiple countries and sectors). Check Point publicly reported “a couple of dozen” customers affected by the LPE exploit. The actual count exposed through PHP2Shell alone may be higher.

Why This Matters to CISOs and Security Leaders

Security gateways are trusted by everything downstream. A compromised firewall sits in front of every inbound and outbound connection. It sees plaintext traffic before encryption, holds VPN credentials and CA certificates, and usually has administrative reach to network segments that nothing else can directly touch. Owning the firewall is not a step toward the target; for many organizations it effectively is the target.

The ESXi pivot is the worst-case multiplier. Most enterprise Check Point deployments run on virtual appliances. Hypervisor access means the attacker can touch every VM on that host, copy disks, snapshot credentials, and in this case wipe everything before anyone responds. Backups stored on the same ESXi cluster are destroyed with the VMs.

The TSGA backdoor survives standard incident response steps. Rebooting the appliance, restoring from a Gaia snapshot, and reviewing running processes will not remove an implant that injects itself into other processes, persists through backup operations, and runs under a name that resembles a legitimate Check Point component. Teams that don’t know what slot_CPconfigdaemon is supposed to look like will walk right past it.

This campaign follows a pattern DataWater has flagged repeatedly in 2026. The edge-device zero-day wave of October showed that firewalls, VPN concentrators, and email gateways are systematically targeted before defenders patch them. The N-central 4EverAble2Shell attack, reported just yesterday, demonstrated again that management tools trusted by the enterprise become the most dangerous machines once compromised. Check Point gateways are trusted more than either of those.

The Timeline

The firewall didn’t fail to stop the attack. The firewall was the attack’s first machine.

Vulnerability & Exploit Analysis

CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) — Initial Access

The PHP2Shell vulnerabilities, rated CVSS 9.2, reside in the Mobile Access portal feature of Check Point gateways. Mobile Access provides browser-based SSL-VPN access to internal applications and is commonly exposed on the internet. The flaws allow an unauthenticated attacker to execute code as the portal service user. Check Point released a security fix approximately one week before exploitation began; organizations that had not applied it by late October were exposed. The PHP2Shell name refers to the attack class: a PHP code injection or execution flaw that provides a command shell to the attacker.

CVE-2026-123039 — Local Privilege Escalation to Root

CVE-2026-123039, rated CVSS 7.8 High, is a local privilege escalation in the Gaia OS management layer. The dynamic_server daemon runs with root privileges and listens on a local socket at /tmp/dynamic_socket. That socket is world-writable: any process on the appliance can connect and send commands, and the daemon executes them as root without verifying the identity of the caller. An attacker who has achieved code execution through PHP2Shell — running at the portal service’s lower privilege level — can reach this socket, send a privileged command, and receive execution as root. The flaw is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource).

Affected and fixed product versions

Note: The specific hotfix take numbers for each release are confirmed in Check Point’s advisory sk1000362. The take numbers listed here are not reproduced to avoid outdated guidance; consult the advisory directly for the current fix for your release.

Attack Chain Analysis

Threat Intelligence Breakdown

Attribution status: contested and unresolved. ESET documented the PhiliKit toolkit in June 2026 and attributed it to Armory Castle, a China-nexus group formerly tracked as UNC5221, based on LightNode VPS infrastructure and network scanning activity concentrated during working hours consistent with Chinese time zones. However, Check Point’s own assessment after analyzing this campaign concludes that the evidence does not support a confident attribution. The group calls itself “Dream Security Ltd.” in its wiper notes, a designation not previously linked to known threat actors. Check Point considers multiple scenarios plausible: the toolkit owner ran the full campaign; the toolkit owner only sold or provided initial access and a separate actor ran the destruction; the destruction was a deliberate false flag; or the politically themed content is a smoke screen. Organizations should not assume China-state actor attribution and should not dismiss it either.

What is confirmed: two coordinated attack waves, a consistent toolkit (PHP2Shell → TSGA → destroy_v6 path), and the use of a scripted, purpose-built backdoor that required substantial development investment. This is not opportunistic ransomware.

Indicators of compromise (sources: THN, BleepingComputer, WindowsForum — defanged):

Check Point’s full advisory sk1000362 contains a more complete IoC list. The indicators above are drawn only from public reporting verified in this run; use sk1000362 for detection rule development.

Enterprise Impact

Organizations running internet-exposed Check Point Mobile Access are at direct risk. The PHP2Shell vector requires no credentials and no user interaction — just reachability to the portal. If you have not applied the PHP2Shell hotfix and your Mobile Access portal is accessible from the internet, the entry path exists today.

ESXi wiper impact is irreversible without tested offsite backups. The destroy_v6 wiper overwrites files before deleting them. Files overwritten at the ESXi layer cannot be recovered through filesystem forensics. Organizations without recent, separately stored, and tested backups face permanent data loss for any VM or storage volume on affected ESXi hosts.

Log integrity cannot be assumed on affected gateways. TSGA tampers with binary firewall logs on the compromised appliance. Any forensic analysis relying solely on logs collected from the gateway itself — rather than from an external SIEM that received logs before tampering — may be incomplete or misleading. This matters for breach-notification scoping and for any incident response that depends on knowing what traffic traversed the firewall.

Downstream blast radius is amplified by gateway trust. A compromised Check Point gateway is trusted by every network segment it protects. It may hold VPN authentication certificates, directory-integration credentials, and administrative keys for downstream infrastructure. All of those should be treated as potentially exfiltrated and rotated as part of incident response.

The attack does not require your organization to be a named target. The November 2 wave was broadly opportunistic. Any enterprise running internet-exposed Mobile Access on an unpatched version was a viable target. This is not a narrowly targeted espionage operation — it ends in destruction for victims who happen to be reachable.

What Security Leaders Should Do Next

Today

1. Identify every internet-exposed Check Point Mobile Access portal in your environment, including DR instances and cloud deployments. Determine the current release and hotfix take number for each.
2. Apply the PHP2Shell and CVE-2026-123039 hotfixes immediately (see sk1000362 for your release). If a maintenance window is unavailable, stop the dynamic_server process and prevent restart as a temporary mitigation for CVE-2026-123039. Restrict Mobile Access portal access to known IP ranges as a temporary mitigation for PHP2Shell.
3. Hunt for TSGA and destroy_v6 indicators: search for processes matching slot_CPconfigdaemon in Gaia OS, check for the DREAM_ANNEXATION.txt file on any ESXi hosts connected to Check Point systems, and review firewall log integrity by comparing on-appliance logs with your SIEM.
4. Rotate vpxuser credentials on ESXi hosts that are reachable from affected gateway management interfaces. Audit SSH access logs for sessions originating from gateway IPs.

Within 48 hours

1. Confirm hotfix installation on every appliance. Verify the take number matches sk1000362 — not just any hotfix taken before this campaign.
2. Review external SIEM for indicators going back to October 23, 2026 (approximate start of exploitation). Look for outbound connections from gateway management IPs, unusual SSH activity, and internal network scanning patterns from gateway-adjacent segments.
3. Audit the full IoC list in sk1000362 against your environment. The public IoCs are a subset; the advisory carries the complete set.
4. If indicators are found, run a full incident response: assume the firewall configuration, certificates, and downstream credentials were exfiltrated. Rebuild affected appliances from clean images rather than restoring from Gaia snapshots (which can contain the TSGA implant if snapshotted after compromise).
5. Verify ESXi backup integrity. If any ESXi host connected to affected gateways is showing anomalies, confirm that offsite backups are intact and test-restore a VM now.

Long-term

1. Establish a named owner for every internet-facing network appliance with a pre-approved emergency change window. Edge devices are targeted systematically; they need faster patch cycles than internal systems.
2. Send logs from all network appliances to an external SIEM in real time. On-box log integrity is not reliable after a root-level compromise. If logs don’t leave the box before they can be tampered, your incident forensics will be incomplete.
3. Segregate gateway management networks from hypervisor management networks. A gateway that can SSH to your ESXi hosts — or whose management interface shares a VLAN with ESXi — creates the lateral movement path that this campaign exploited.
4. Test your ESXi recovery procedure quarterly. The destroy_v6 wiper is explicitly designed to leave no recovery path without tested offsite backups. Knowing you have backups is not the same as knowing you can restore from them in time.
5. Review all remote-access features exposed to the internet across your firewall and VPN estate. October 2026’s wave of edge-device zero-days showed that every exposed management or access feature is a potential entry point.

Winners and Losers

Final Executive Takeaway

Your firewall is no longer a neutral observer of attacks. It is a target — and in this campaign, it was the entry point, the persistence layer, and the pivot to data destruction.

The Check Point attack chain is a blueprint for how security infrastructure itself gets weaponized. PHP2Shell gave the attackers their foothold. CVE-2026-123039 gave them root. TSGA gave them persistence and log-tampering capability. And the connection from firewall to hypervisor gave them the ability to wipe everything downstream. Each link in the chain was predictable and each break in the chain would have stopped the attack.

CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13. That is the government’s formal acknowledgment that this exploit is in active, confirmed use. The remediation path is clear: apply the Jumbo Hotfix Accumulator for your Check Point release, hunt for TSGA indicators on every gateway that may have been exposed since late October, and isolate ESXi hosts from gateway management networks before the next wave begins.

If you have internet-facing Mobile Access portals running unpatched releases, run incident response steps today. Patch tonight. Verify tomorrow.

Frequently Asked Questions

Sources

Primary and direct-reporting sources: The Hacker News — Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files (Nov 13, 2026); BleepingComputer — Check Point patches zero-day that lets hackers get root access; CSO Online — The firewall becomes the foothold (Nov 13, 2026); WindowsForum — CISA KEV Alert: CVE-2026-123039; CISA Known Exploited Vulnerabilities Catalog (CVE-2026-123039 added Nov 13, 2026). Attack chain and IoC details confirmed across THN and BleepingComputer; attribution and toolkit details from THN citing ESET (single-source for Armory Castle links). Single-source claims noted in text. Reflects public reporting as of November 14, 2026.