Attackers exploit PHP2Shell flaws to take over Check Point gateways and deploy a wiper

Check Point reports that attackers have exploited the PHP2Shell vulnerabilities to hack its gateway appliances and deploy destructive malware. PHP2Shell refers to two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which affect all PHP versions from PHP 5 onward. Patches came out on October 21, but exploitation began days earlier and spread widely soon after. In the Check Point campaign, the attackers used PHP2Shell for initial access. They then exploited CVE-2026-123039, a local privilege escalation flaw in the DynamicCLI process, to get root access, install PHP webshells and stay on the devices. A destructive first wave began on October 30 and targeted Israeli organizations. A second wave began on November 2 and hit organizations in several countries. According to The Hacker News, the attackers deployed a backdoor called TSGA and wiped ESXi files. The attackers left a note that mentions Check Point. Separately, researchers at Dream have linked PHP2Shell attacks on Palo Alto Networks firewalls to Chinese hackers. Organizations running affected gateways should confirm that both the PHP fixes and the privilege escalation patch are installed.