As reported by The Hacker News, threat actors have chained multiple Check Point Security Gateway vulnerabilities—including the PHP2Shell flaws and a newly tracked local privilege escalation issue—to deploy the TSGA backdoor and ultimately a wiper targeting VMware ESXi hosts. The attack timeline is notable: exploitation began approximately one week after patches were available, underscoring a shrinking window for defenders.
The Vulnerability Chain
This incident illustrates a textbook kill-chain progression from external exposure to internal destruction:
| CVE | Severity | Function | Exploited in Wild |
|---|---|---|---|
| CVE-2026-109618 | Critical | PHP2Shell initial access via Mobile Access portal | Yes |
| CVE-2026-109619 | Critical | PHP2Shell initial access component | Yes |
| CVE-2026-123039 | High (CVSS 7.8) | Local privilege escalation to root via DynamicCLI missing authorization | Yes — dozens of customers |
Affected Products and Versions
The attackers pivoted from the gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed DREAM_ANNIXATION.txt notes — a hallmark of destructive, politically motivated operations rather than purely financially driven crime.
Why This Matters
Three elements of this campaign demand attention from security leaders:
1. The Patch-to-Exploitation Window Is Collapsing
The threat actor began exploiting these vulnerabilities roughly seven days after remediation was available. This is consistent with a broader trend where threat actors monitor vendor disclosures and rapidly weaponize proofs-of-concept. Organizations that operate on monthly or quarterly patch cycles for network infrastructure are operating in a danger zone.
2. Edge Devices Are High-Value Targets
Security gateways sit at the network perimeter, handle encrypted traffic, and often have privileged access to internal segments via SSH or management protocols. Compromising a gateway does not just breach the perimeter—it provides a trusted jumping-off point that bypasses much of the internal monitoring architecture. The pivot to ESXi via SSH from the gateway demonstrates how network trust relationships become liabilities.
3. Destruction Follows Espionage
The deployment of wiper malware alongside the TSGA backdoor suggests the threat actor's objectives extend beyond intelligence collection. The politically themed notes and the targeting pattern—initial focus on Israeli organizations followed by broader international targeting—indicate possible state-sponsored or politically aligned activity. Defenders should recognize that reconnaissance and persistence phases may precede destructive action by only days.
Immediate Actions
- Patch immediately: Apply the security fixes for all affected Check Point products. If patching cannot be completed within hours, implement interim mitigations per vendor guidance.
- Disable or restrict Mobile Access portals: If the Mobile Access portal is not business-critical, disable it until patched. If required, restrict access via IP allowlisting and enforce MFA.
- Audit SSH trust relationships: Review and restrict SSH access from gateways to internal hosts, particularly ESXi hypervisors. Implement jump host architecture with credential vaulting.
- Hunt for indicators: Search for PHP web shells, unauthorized PHP files in web-accessible directories, and the TSGA backdoor persistence mechanism. Review DynamicCLI command history logs for suspicious root-level activity.
- Check for ESXi exposure: Verify ESXi host integrity and look for DREAM_ANNIXATION.txt files or destroy_v6 wiper artifacts.
Shield53 Recommendations
- Treat edge infrastructure as Tier-0 assets: Security gateways should receive the same hardening scrutiny as domain controllers and identity providers. This includes rapid patch SLAs (24–72 hours for critical vulnerabilities), continuous configuration monitoring, and dedicated detection content.
- Implement network segmentation between gateways and virtualization hosts: No direct SSH from perimeter devices to ESXi should exist without a controlled and monitored jump path.
- Deploy behavioral detection for gateway appliances: Monitor for unexpected process spawns, PHP execution from non-standard directories, and DynamicCLI socket writes from non-administrator accounts.
- Establish an emergency patch procedure: Create a pre-approved expedited patch workflow for critical edge device vulnerabilities that bypasses standard change management for severity-critical advisories.
- Back up ESXi environments immutably: Wiper attacks targeting hypervisors can destroy entire virtualization estates. Ensure offline, immutable backups exist and are tested for recovery.
The convergence of edge device exploitation, sophisticated persistence mechanisms, and destructive payloads represents an escalation in threat actor capability and intent. Organizations running Check Point infrastructure should treat this as an active incident response scenario—not a routine patching task.
