Attackers exploited PHP2Shell vulnerabilities in Check Point Gateway appliances in two waves, beginning with destructive attacks on Israeli organizations on October 30 before expanding to organizations in multiple countries from November 2.

The flaws, CVE-2026-109618 and CVE-2026-109619, enable remote code execution across PHP versions from PHP 5 onward; PHP released patches on October 21, and CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26.

After gaining initial access through PHP2Shell, the attackers exploited CVE-2026-123039, a local privilege-escalation flaw in the DynamicCLI process, to obtain root access, install PHP webshells and maintain persistence.

Investigators found suspicious PHP session files marked `upload_progress_pwn` and repeated crashes of portal Apache and PHP processes; the webshells enabled command execution, PHP execution and file uploads.

The attackers also deployed TSGA, a Check Point-focused backdoor with encrypted remote access, configuration theft, persistence, process injection and log-tampering capabilities, alongside TSProxy, which encrypted and selectively redirected network connections.

From compromised gateways, the attackers mapped internal networks, scanned for VMware ESXi hosts and moved to them over SSH using the `vpxuser` service account.

On affected ESXi hosts, they ran `destroy_v6`, a wiper that deletes files and can overwrite data with zeros to hinder recovery, or run in a faster mode without overwriting.

A file named DREAM_ANNEXATION.txt found on an affected ESXi host contained political messages rejecting ransom negotiations, pointing to disruption as a possible goal while also raising the possibility of a false-flag operation.

Check Point assessed TSGA and TSProxy as Check Point-specific components of PhiliKit, a toolkit previously documented by ESET and associated with UNC5221, but said the evidence was insufficient to confidently attribute this campaign to that group or another known actor.

Some indicators, including activity during typical Chinese working hours and China-linked malware and infrastructure, suggested possible Chinese links, but the attacks’ destructive nature, Israeli focus and political messages did not clearly fit known Chinese operations; Check Point said attribution remains uncertain.

Check Point said possible explanations include one actor conducting the campaign, an initial-access broker supplying access to another group, a false flag, or destruction used as a smokescreen; a possible connection to Dream Security research remains unproven.

Administrators should inspect exposed gateways for `upload_progress_pwn` session files, unexpected CPconfigdaemon processes or binaries, unexplained firewall-log gaps and unauthorized SSH connections from gateways to internal VMware ESXi hosts.