Attack Details
Check Point has revealed a cyberattack campaign targeting its Security Gateways, where attackers exploited critical PHP vulnerabilities known as PHP2Shell (registered under CVE-2026-109618 and CVE-2026-109619). These attacks began on October 30, 2026, initially targeting organizations within Israel, before expanding on November 2 to include companies across various countries and sectors.
Infiltration and Propagation Mechanism
The attackers used the PHP2Shell vulnerability for unauthorized access via the Mobile Access portal, then exploited a new zero-day vulnerability, CVE-2026-123039, to gain root privileges. Subsequently, backdoors such as TSGA were installed, which include a network component called TSProxy to hide attacker commands within normal traffic.
In the attacks targeting Israeli organizations, the attackers moved from the compromised gateways to VMware ESXi servers using the open-source network reconnaissance tool gogo. In the final stage, a data-wiping malware called destroy_v6 was deployed, which repeatedly deletes data with an option to overwrite spaces with zeros to prevent file recovery.
Why this news matters
This attack poses a significant risk due to its destructive nature, which aims to disrupt business operations rather than demand ransom, as confirmed by political messages left by the attackers on the compromised systems. The report also highlights the danger of combining application vulnerabilities with system vulnerabilities (such as the Fragnesia vulnerability in the Linux kernel) to gain full privileges.
Protection Recommendations
Check Point recommends that all its customers take the following actions immediately:
- Install the November Jumbo Hotfix on all management servers and security gateways, prioritizing internet-facing gateways.
- Search for indicators of compromise such as session files containing upload_progress_pwn.
- Monitor for unexpected CPconfigdaemon processes or the presence of unexplained binary files.
- Inspect firewall logs for any unauthorized SSH activity from the gateway to internal VMware ESXi servers.