As reported by BleepingComputer, a coordinated attack campaign is actively exploiting Check Point Security Gateways via the PHP2Shell vulnerabilities, ultimately deploying data-wiping malware on VMware ESXi hosts. This is not a theoretical risk — it is a live, multi-stage intrusion chain that has already caused destructive impact, particularly against Israeli organizations starting October 30, 2026, with a second wave expanding geographically on November 2.
What makes this campaign particularly notable from a defensive standpoint is the deliberate chaining of multiple vulnerabilities across different layers: application-level RCE, privilege escalation, and lateral movement into virtualization infrastructure. The threat actor's endgame — deploying a wiper called destroy_v6 on ESXi hosts — signals a destructive intent that goes beyond data theft or extortion. The dropped note rejecting ransom negotiations reinforces this assessment.
Vulnerability Chain Summary
| CVE | Description | Severity | Patch Status | Active Exploitation |
|---|---|---|---|---|
| CVE-2026-109618 | PHP2Shell — Unauthenticated RCE in PHP | Critical | Patched Oct 21 (PHP emergency release) | Yes — observed in the wild |
| CVE-2026-109619 | PHP2Shell — Unauthenticated RCE in PHP | Critical | Patched Oct 21 (PHP emergency release) | Yes — observed in the wild |
| CVE-2026-123039 | Check Point gateway privilege escalation (zero-day at time of attacks) | High/Critical | Check Point advisory — verify vendor portal | Yes — exploited in this campaign |
Additionally, CISA has warned that attackers are chaining the PHP2Shell bugs with the Fragnesia Linux kernel flaw for root-level privilege escalation. Both CVE-2026-109618 and CVE-2026-109619 were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026.
Attack Chain Analysis
The intrusion path follows a predictable but dangerous pattern:
DREAM_ANNEXATION.txt left on compromised hosts, containing political messaging and explicitly rejecting ransom negotiation.The potential link between TSGA/TSProxy and the PhiliKit malware framework — previously associated with UNC5221 (a Chinese threat cluster) — combined with the political messaging raises credible false-flag concerns. Defenders should not over-index on attribution; the TTPs matter more than the claimed identity.
Who Is Most at Risk
- Organizations running unpatched Check Point Security Gateways with Mobile Access portals exposed to the internet
- Environments where gateway appliances have direct network paths to ESXi/vSphere infrastructure without segmentation
- Israeli organizations (first wave) and any organization in the second wave's expanded targeting scope
- Organizations running unpatched PHP versions on any internet-facing server, not just Check Point appliances
Shield53 Recommendations
Immediate Actions
- Patch PHP immediately on all systems, especially those powering internet-facing appliances. Ensure you are running versions released on or after October 21, 2026.
- Apply Check Point security updates for CVE-2026-123039. Check the Check Point support portal for the latest hotfix and verify gateway version.
- Restrict Mobile Access portal exposure. If the Mobile Access portal does not need to be internet-facing, disable it or place it behind a VPN/allowlist. This is the confirmed entry point.
- Review CISA KEV catalog entries for CVE-2026-109618 and CVE-2026-109619 and ensure compliance with federal remediation deadlines if applicable.
- Segment gateway-to-ESXi network paths. Gateway appliances should not have unrestricted access to virtualization management networks. Implement firewall rules restricting traffic from gateway VLANs to ESXi hosts and vCenter.
Detection & Hunting
- Hunt for TSProxy and TSGA indicators on Check Point appliances — look for unexpected PHP files in web-accessible directories and anomalous network listeners.
- Search for
gogoscanner artifacts on gateway and adjacent systems — this tool fingerprints ESXi hosts and may appear in process logs or network flow data. - Monitor for
destroy_v6wiper — look for the binary, theDREAM_ANNEXATION.txtfile, and rapid zero-fill write patterns on ESXi datastores. - Review gateway logs for unauthenticated access anomalies to the Mobile Access portal dating back to October 26, 2026.
- Check ESXi host integrity — verify datastore integrity, look for mass file deletion events, and examine hostd and vmkernel logs for signs of compromise.
Strategic Recommendations
- Treat edge appliances as high-risk assets. Security gateways are both your first line of defense and a prime target. They require the same patching rigor as any internet-facing server.
- Implement outbound restrictions on gateway appliances. Limit the ability of compromised gateways to scan internal networks by applying egress filtering between the gateway VLAN and internal segments.
- Assume destructive intent, not just data theft. Incident response playbooks must include wiper-specific procedures: rapid isolation, immutable backup verification, and ESXi host rebuild protocols.
- Do not rely on attribution for defense. Whether this is UNC5221, a false-flag operation, or a new actor, the TTPs are clear. Defend against the chain, not the name.
This campaign is a textbook example of why edge security devices require the same — if not greater — security hygiene as the crown jewels they protect. A compromised gateway is not just a breached perimeter; it is a launching pad into the soft underbelly of virtualization infrastructure. Patch now, segment aggressively, and hunt for indicators of compromise dating back weeks.
