Hackers Turned Check Point Firewalls Into a Launchpad for Wiping VMware Servers, Chaining a Month-Old PHP Bug With a Root Zero-Day as CISA’s Patch Deadline Arrives Monday

The device that is supposed to keep attackers out became the way in. Since October 30, an unidentified group has been breaking into unpatched Check Point Security Gateways through their remote-access login portals, taking full root control of the appliances, and in some cases moving inward to destroy data on VMware ESXi servers, according to Check Point Research. The U.S. Cybersecurity and Infrastructure Security Agency has given federal agencies until Monday, November 16, to fix the privilege-escalation flaw at the center of the campaign, Security Affairs reports.

For any company that runs Check Point gear at its network edge, and for every business that relies on a VPN or firewall appliance it rarely thinks about, this is a weekend story worth reading closely.

How the Attack Chain Works

Check Point’s researchers describe a three-step intrusion that turns two separate weaknesses into complete control of a gateway:

• Initial access through PHP2Shell. The attackers first hit the Mobile Access portal using PHP2Shell, the nickname for two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. PHP shipped emergency fixes on October 21, and CISA added both bugs to its Known Exploited Vulnerabilities (KEV) catalog on October 26, BleepingComputer reports.
• Root through a zero-day. Once inside, the attackers abused CVE-2026-123039, a flaw in Check Point’s Gaia OS. A root-level daemon called DynamicCLI listens on a world-writable local socket without checking who is connecting, so any authenticated local user can have commands run as root, according to the company’s advisory as quoted by BleepingComputer. Check Point said it saw active exploitation “against a couple of dozen customers.”
• Persistence and destruction. With root access, the intruders planted PHP webshells and a backdoor called TSGA, whose embedded TSProxy component hides attacker commands inside normal-looking traffic. In the destructive cases, they scanned the internal network, jumped to VMware ESXi hosts over SSH, and ran a wiper named destroy_v6 that recursively deletes files and can zero-fill them first to frustrate recovery, per Check Point Research.

Security Affairs lists the Check Point flaw with a CVSS score of 7.8. That “high” rather than “critical” label is misleading on its own: the bug only needs a foothold, and PHP2Shell supplied one to anyone who could reach an unpatched portal from the internet.

Two Waves, One Destructive

According to Check Point Research, the first wave on October 30 targeted Israeli organizations and included destructive activity against some of them. A wider second wave began on November 2 and hit organizations in multiple countries and sectors, and the researchers found no evidence of wiping in that round. Check Point noted that the Israeli intrusions came roughly one week after a fix became available, which is exactly the window attackers now count on.

On wiped ESXi hosts, the attackers left a note named DREAM_ANNEXATION.txt that uses the branding of Dream Security, carries political messages, and explicitly refuses any ransom negotiation, BleepingComputer reports. In other words, this was not a ransomware shakedown. The goal of that stage appears to have been damage.

A Murky Attribution Picture

Check Point found that TSGA and TSProxy are modified versions of PhiliKit, a malware framework previously seen in attacks on Ivanti appliances and which ESET has associated with UNC5221, a China-nexus cluster. But the researchers stop short of naming a culprit. They lay out several possibilities: one actor ran the entire operation, the group acted only as an initial access broker for someone else, or the whole thing was a false flag. They also raise the chance that the destructive activity was a smoke screen for something quieter, per Check Point Research. Dream Security had recently published research on PHP2Shell attacks against Palo Alto Networks devices, which makes retaliation one theory, but Check Point says the evidence does not establish a clear motive.

Why It Matters for Business

Edge devices are now the front door. Firewalls, VPN concentrators and remote-access portals sit on the internet by design, run with high privileges, and are often patched less often than laptops. This campaign follows the same playbook seen against Ivanti and other edge appliances: break the perimeter box, then use its trusted position to reach the crown jewels.

Virtualization multiplies the damage. A single ESXi host can carry dozens of servers. Wiping it at the hypervisor level can take down file shares, line-of-business apps and databases at once, which is why attackers have made ESXi a favorite target.

The patch gap is a business risk, not an IT detail. PHP’s fix was out on October 21 and the first destructive intrusions began nine days later. Organizations that treat appliance updates as a quarterly chore are giving attackers weeks they no longer need. It is also a pattern: BleepingComputer notes that Check Point warned in September about two other zero-day remote code execution flaws, and that CISA has added five Check Point bugs to its KEV catalog over the past two years, two of them used by ransomware gangs.

Destructive attacks change the recovery math. When the attacker does not want money, there is no decryption key to buy. Recovery depends entirely on offline, tested backups and a rebuild plan for hypervisors.

What Security Teams Should Do Now

Check Point’s guidance, summarized by BleepingComputer and The Hacker News, comes down to a short list:

• Install the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with any gateway that exposes a Mobile Access portal to the internet. It addresses both PHP2Shell and the DynamicCLI flaw.
• If the hotfix cannot go on immediately, stop the dynamic_server process and keep it from restarting as a temporary mitigation.
• Hunt for signs of compromise on gateways that were exposed: session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, unexplained gaps in firewall logs, and commands that bypass the default Clish wrapper.
• Treat any unexplained SSH connection from a gateway to an internal ESXi host as a confirmed breach and respond accordingly.
• Confirm that hypervisor backups are offline or immutable, and that a restore has actually been tested.

The product lines named in the advisory include Check Point’s Firewall, Security Gateway, Security Management Server, Multi-Domain Security Management Server and Scalable Platforms, according to BleepingComputer. Check Point has also published indicators of compromise in Check Point’s security advisory.

The Bottom Line

This campaign is a reminder that the most dangerous attacks often start on the appliances companies trust most. A month-old PHP bug plus an unauthenticated root socket was enough to turn security gateways into a path to wiped servers, and the attribution is still unclear. Federal agencies face a Monday deadline. Private companies running these products should hold themselves to the same one, then verify they were not already breached before the patch went on.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous