{"id":4219,"date":"2026-11-13T06:48:54","date_gmt":"2026-11-13T14:48:54","guid":{"rendered":"https:\/\/cyber.mag212.com\/check-point-php2shell-cve-2026-123039-gateway-intrusions-esxi-wiper-tsga\/"},"modified":"2026-11-13T06:48:54","modified_gmt":"2026-11-13T14:48:54","slug":"check-point-php2shell-cve-2026-123039-gateway-intrusions-esxi-wiper-tsga","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/check-point-php2shell-cve-2026-123039-gateway-intrusions-esxi-wiper-tsga\/","title":{"rendered":"From a VPN Portal to an ESXi Wiper: Inside the Check Point Gateway Intrusions (PHP2Shell and CVE-2026-123039)"},"content":{"rendered":"\n

A firewall is supposed to be the thing that stops an intrusion, not the place one begins. Check Point has now described how attackers turned roughly two dozen of its unpatched Security Gateways into exactly that: they broke in through the Mobile Access portal, took root on the appliance, hid an implant inside it and, in a small number of cases, reached across to VMware ESXi hosts and wiped them. Fixes had been available for a week before the first attack. This is what happened, how to tell whether it happened to you, and what to do first.<\/p>\n\n\n\n

Entry<\/strong><\/td>PHP2Shell (CVE-2026-109618\/-109619, 9.2), Mobile Access portal<\/td><\/tr>
To root<\/strong><\/td>CVE-2026-123039 (7.8), Gaia DynamicCLI<\/td><\/tr>
Scale<\/strong><\/td>“A couple of dozen” unpatched systems, one region<\/td><\/tr>
Fix<\/strong><\/td>November Jumbo Hotfix on gateways and management<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> Check Point says attackers exploited PHP2Shell<\/strong>, a PHP flaw that also affects its Security Gateways, through the Mobile Access portal<\/strong>. They then used a Gaia privilege-escalation flaw, CVE-2026-123039<\/strong>, to get root and persistence. Activity ran from 30 October to 4 November<\/strong>, a week after fixes shipped on 23 October. Only “a couple of dozen unpatched systems, in a single region” were compromised. In many cases the attacker got a foothold in the network; in a limited number the activity was destructive and ideologically motivated. Check Point notified affected customers and helped remediate. (Check Point advisory<\/a>)<\/p>\n\n\n\n

[Confirmed]<\/strong> Check Point Research describes two waves. The first, on 30 October, targeted Israeli organisations and included destructive activity against some. The second, on 2 November, hit organisations in several countries and sectors with no sign of destruction. (Check Point Research<\/a>)<\/p>\n\n\n\n

\"Five-stage
Figure 1 \u00b7 From VPN portal to ESXi wiper.<\/strong> The five stages Check Point Research describes, with the artifacts each one leaves. How the ESXi credential was obtained is unknown. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected<\/h2>\n\n\n\n
CVE<\/th>What<\/th>Affected<\/th>Exploited<\/th><\/tr><\/thead>
CVE-2026-109618 \/ -109619<\/td>PHP2Shell: unauthenticated RCE via firewall web interfaces (9.2)<\/td>Security Gateways with Mobile Access Portal, R80 to R82.20; Spark R81.10.x, R82.00.x, R77.20.x, R80.20.x<\/td>Yes<\/strong><\/td><\/tr>
CVE-2026-123039<\/td>Local privilege escalation in the Gaia DynamicCLI service (7.8)<\/td>Gaia R81.20, R82, R82.10, R82.20<\/td>Yes<\/strong><\/td><\/tr>
CVE-2026-107484<\/td>Gaia Portal privilege escalation by an authenticated user (7.3)<\/td>Gaia WebUI R80 to R82.20<\/td>No<\/td><\/tr>
CVE-2026-120490<\/td>Management-to-gateway access via NAT rule (3.8)<\/td>R81.20, R82<\/td>No<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Source: Check Point advisory<\/a> (SK references sk1000302, sk1000362, sk1000291, sk1000364). The November Jumbo Hotfix also includes the Node2Shell\/Brotli fix CVE-2026-111497.<\/em><\/p>\n\n\n\n

How the attack works<\/h2>\n\n\n\n

[Confirmed]<\/strong> In the intrusion Check Point investigated, the attacker:<\/p>\n\n\n\n

    \n
  1. Exploited the portal, leaving PHP session files with upload_progress_pwn<\/code> under \/opt\/CPcvpn-R81.20\/tmp\/<\/code> and causing hundreds of Apache\/PHP worker crashes.<\/li>\n\n\n
  2. Escalated from the portal’s service account to root through DynamicCLI.<\/li>\n\n\n
  3. Wrote PHP web shells as zz*.tpl<\/code> login-page templates, using the key zz2026<\/code>, with uploads saved to \/tmp\/.up.tpl<\/code>.<\/li>\n\n\n
  4. Launched the TSGA<\/strong> implant from \/tmp\/CPconfigdaemon<\/code>, which relaunches as slot_CPconfigdaemon<\/code>. TSGA drops TSProxy<\/strong> to \/lib\/libcpfwcommon.so<\/code> and injects it into appliance processes to hide attacker connections. It can also steal configuration, persist in backups and snapshots, and tamper with firewall logs.<\/li>\n\n\n
  5. Scanned the internal network with the gogo<\/em> scanner, then used SSH as vpxuser<\/code> to reach a VMware ESXi<\/strong> host and run the destroy_v6<\/code> wiper, which left DREAM_ANNEXATION.txt<\/code> notes rejecting ransom.<\/li>\n\n<\/ol>\n\n\n\n

    (Check Point Research<\/a>) [Unknown]<\/strong> How the attacker obtained a working ESXi credential. [Reported]<\/strong> TSGA and TSProxy are modified variants of PhiliKit<\/strong>, a backdoor seen in Ivanti VPN attacks that ESET associated with China-nexus UNC5221. Check Point says the evidence doesn’t support a confident attribution: the actor may have run the whole campaign, acted as an access broker, or staged a false flag.<\/p>\n\n\n\n

    Gateway and ESXi hunt<\/h3>\n\n\n\n

    OS: Gaia (expert mode) \u00b7 ESXi shell \u00b7 Shell: bash \/ sh \u00b7 Privileges: expert (root) \u00b7 ESXi admin \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

    # Gaia: installed Jumbo Hotfix take\ncpinfo -y all 2>\/dev\/null | grep -i -A2 'HOTFIX'\n# Portal exploitation marker and template web shells\ngrep -l 'upload_progress_pwn' \/opt\/CPcvpn-*\/tmp\/sess_* 2>\/dev\/null\nfind \/ -xdev \\( -name 'zz*.tpl' -o -name 'challenge_render.tpl' -o -name '*CPconfigdaemon' \\\n  -o -name 'libcpfwcommon.so' \\) 2>\/dev\/null\nls -la \/tmp\/.bd.log \/tmp\/.up.tpl \/tmp\/.p_sock 2>\/dev\/null\nnetstat -tlnp 2>\/dev\/null | grep ':11072'\n# ESXi: SSH logins as vpxuser (run on each host)\ngrep -i 'vpxuser' \/var\/log\/auth.log | grep -i 'sshd'<\/code><\/pre>\n\n\n\n
    Expected clean result: a current November take, and no output from the other commands. Any hit means a full compromise: isolate the device and call incident response before changing it. Commands not tested by MAG212 CYBER.<\/strong> Indicators from Check Point Research<\/a>; check exact paths against your Gaia version.<\/p>\n\n\n\n
    Investigate, contain and remediate (in order)<\/h2>\n\n\n\n
      \n
    1. Preserve evidence off the box first:<\/strong> remote syslog, SmartConsole logs, upstream NetFlow and vCenter\/ESXi auth logs. TSGA can tamper with local firewall logs, so gaps after a logging-daemon crash are themselves a signal.<\/li>\n\n\n
    2. Block<\/strong> 130.94.19[.]204<\/code> and .168<\/code>, and restrict traffic from gateways to hypervisor management networks.<\/li>\n\n\n
    3. Install the November Jumbo Hotfix<\/strong> on all management servers and gateways, internet-facing Mobile Access first (for example R81.20 Take 174, R82.10 Take 52). (R81.20<\/a>) (R82.10<\/a>)<\/li>\n\n\n
    4. [MAG212 analysis]<\/strong> If any indicator matches, rebuild rather than clean.<\/strong> TSGA persists in backups and snapshots, so check backups before restoring. Then rotate VPN, admin and vpxuser<\/code>\/vCenter credentials.<\/li>\n\n<\/ol>\n\n\n\n
      Verify recovery:<\/strong> the take is confirmed on both cluster members; there’s no listener on 11072; ESXi shows no SSH from gateways; and policy install, VPN login and failover work. Prevention<\/strong> [MAG212 analysis]<\/strong>: a firewall should never be able to SSH to your hypervisors. Put ESXi management behind its own boundary, disable ESXi SSH when it’s not in use, and keep firewall logs somewhere the firewall can’t edit.<\/p>\n\n\n\n
      What makes this intrusion different<\/h2>\n\n\n\n
      [MAG212 analysis]<\/strong> Exploited VPN appliances are not new. What stands out here is how far the attacker went after the initial break-in. Root on a gateway gave them a position that most security tools can\u2019t see into: the implant hid its own network connections inside legitimate appliance processes, and Check Point Research says it could tamper with the firewall\u2019s own logs. From there, the attacker treated the firewall as a jump host into the data centre.<\/p>\n\n\n\n
      [MAG212 analysis]<\/strong> The destructive stage targeted virtualisation, not individual servers. Wiping an ESXi host takes down every virtual machine on it at once, which is why ransomware crews have focused on hypervisors for years. Here there was no ransom: the note rejected payment, and Check Point describes the destructive activity as ideologically motivated. That makes backups and recovery speed, not negotiation, the only defence.<\/p>\n\n\n\n
      [Reported]<\/strong> Attribution is unresolved. The implant is a modified version of a backdoor seen in earlier Ivanti VPN attacks, but Check Point says the evidence fits several explanations, including an access broker or a deliberate false flag. Defenders don\u2019t need to settle that question to act: the indicators and the fixes are the same.<\/p>\n\n\n\n
      Why it matters<\/h2>\n\n\n\n
      Edge devices and hypervisors are two of the most valuable systems in any network, and this campaign joined them. Every organisation that runs a VPN appliance in front of a virtualised data centre should ask whether the firewall can talk to the hypervisor\u2019s management interface. In this intrusion it could, and that single path turned a perimeter compromise into destroyed infrastructure. The week between the fix and the first exploitation is also a reminder that patch windows for edge devices are now measured in days.<\/p>\n\n\n\n
      The bottom line<\/h2>\n\n\n\n
      Install the November Jumbo Hotfix on every Check Point gateway and management server, starting with internet-facing Mobile Access. Run the hunt on each gateway and check ESXi for SSH logins from the firewall. If anything matches, preserve the logs off the box, rebuild rather than clean, rotate VPN, admin and vCenter credentials, and cut the network path from gateways to hypervisor management for good.<\/p>\n\n\n\n
      How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
      \n\n\n\n
      This story is part of MAG212 CYBER Daily, 13 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
      Check Point says attackers chained the PHP2Shell flaw in the Mobile Access portal with a Gaia privilege escalation, CVE-2026-123039, to get root on unpatched gateways, plant a stealthy implant and, in some cases, wipe VMware ESXi hosts. Affected versions, indicators, a hunt and the order of response.<\/p>","protected":false},"author":1,"featured_media":4217,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,15],"tags":[227,344,263,33,342,343],"class_list":["post-4219","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-threat-intelligence","tag-check-point","tag-firewall-security","tag-iocs","tag-php2shell","tag-vmware-esxi","tag-wiper"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4219"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4219\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4217"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}