Check Point Confirms PHP2Shell Exploitation; Limited Cases Also Involved Data Deletion on ESXi
Attackers actively exploited the PHP2Shell vulnerability chain and privilege escalation in Check Point Security Gateways. In a limited number of investigated cases, they deployed implants and wiper malware against VMware ESXi.
Check Point PHP2Shell was actively exploited against internet-facing Mobile Access portals, according to the vendor. In a limited number of investigated cases, attackers deployed implants after gaining root privileges and moved via SSH to VMware ESXi hosts, where they launched wiper malware.
Check Point published an alert on November 12. It stated that the observed exploitation activity began on October 30, 2026, and continued through November 4. The first wave targeted Israeli organizations, while the second wave, on November 2, targeted organizations across multiple countries and sectors.
Check Point PHP2Shell and escalation to root
The PHP2Shell chain consisted of vulnerabilities CVE-2026-109618 and CVE-2026-109619, which attackers combined with local privilege escalation CVE-2026-123039. According to Check Point, this procedure gave them root access to the affected gateway.
In the investigated intrusion, they then deployed a PHP web shell, the persistent TSGA implant, and the TSProxy component. These tools could have enabled persistent access, configuration theft, and lateral movement within the network; the fact sheet does not confirm them as the outcome of all attacks.
Security gateways are critical perimeter systems because they provide remote access and communication with internal infrastructure. The risk is especially relevant for Mobile Access portals exposed directly to the internet.
In a limited number of cases, the attack continued against VMware ESXi
In a limited number of investigated cases, Check Point observed attackers moving via SSH from a compromised gateway to a VMware ESXi host. They launched wiper malware identified as destroy_v6 and left behind a file named DREAM_ANNEXATION.txt.
It has not been confirmed how many organizations suffered a destructive attack or what the extent of the damage to ESXi systems was. There is likewise no evidence that data destruction was part of the broader second wave on November 2.
The attackers’ identity and motivation have not yet been confirmed. Check Point does not consider the links between TSGA and TSProxy and PhiliKit tools, or clues associated with China-linked actors, sufficient for reliable attribution. It also allows for the possibility of a false-flag operation.
Fixes were available; Check Point recommends the November package
According to Check Point, a hotfix for PHP2Shell was available as of October 23. Organizations should install the November Jumbo Hotfix on both Management Servers and Security Gateways. For CVE-2026-123039, the vendor also lists a temporary mitigation: disabling the Dynamic CLI service if operationally acceptable.
Administrators should also check for possible signs of compromise using the indicators published by Check Point. Tracked artifacts include the string upload_progress_pwn, processes masquerading as CPconfigdaemon, suspicious files in the /tmp directory, and firewall log outages.
The Canadian Centre for Cyber Security confirmed in its own alert that Check Point identified CVE-2026-123039 as a vulnerability exploited in the wild. Further developments will show whether security vendors or government agencies provide independent data on the campaign’s scope and origin.
Sources
- Check Point Research – Technical attack details, deployment of TSGA/TSProxy, lateral movement to ESXi, destroy_v6, timeline, and attribution ambiguity.
- Check Point Blog – Confirmation of active exploitation, patch availability, scope of observed compromises, recommended updates, and indicators of compromise.
- Canadian Centre for Cyber Security – Independent government confirmation that Check Point identified CVE-2026-123039 as being exploited in the wild.
Verified and updated: November 13, 2026 15:24
