PHP2Shell and CVE-2026-123039

An unknown threat actor has broken into unpatched Check Point Security Gateways, taken root on the appliance, installed a gateway-specific backdoor, and in some cases used that foothold to wipe VMware ESXi hosts further inside the network. Check Point says the root escalation step, CVE-2026-123039, was used against about two dozen customers. CISA added it to the Known Exploited Vulnerabilities catalog on November 13, 2026, and gave federal agencies until November 16 to patch.

The campaign began on October 30, 2026, against Israeli organizations, about one week after a fix for the PHP2Shell flaws was released. A second, wider wave on November 2 hit organizations in several countries and sectors with no clear targeting pattern, which points to an opportunistic push for initial access.

The Intrusion Chain

Check Point traced the first wave to 130.94.19[.]204 scanning Mobile Access portals on Security Gateways. The activity matched PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, and some of those attempts led to confirmed compromises. PHP2Shell gave the attacker code execution as the portal service account. That is not root, so a second bug was needed.

That second bug is CVE-2026-123039, a missing authorization flaw in the Gaia OS DynamicCLI process. Any authenticated local user can run arbitrary commands as root by writing a single request to the DynamicCLI socket. On its own it is a local escalation and needs existing code execution on the box. Chained after PHP2Shell, it turns an exposed web portal into full control of the firewall.

• Initial access: PHP2Shell (CVE-2026-109618, CVE-2026-109619) through Mobile Access portals
• Privilege escalation: CVE-2026-123039 through the DynamicCLI socket, portal service account to root
• Persistence: PHP web shells with command execution and file upload
• Implant: TSGA, deployed as slot_CPconfigdaemon, with its embedded TSProxy component
• Discovery: the gogo scanner, run from the gateway to map internal assets and services
• Lateral movement: SSH to a VMware ESXi host using the vpxuser service account
• Impact: the destroy_v6 wiper plus DREAM_ANNEXATION.txt notes

Affected Versions

CVE-2026-123039 affects R82.20, R82.10, R82, R81.20, R81.10 and R81 on Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator. The PHP2Shell entry point needs Mobile Access exposed. Because the escalation works on any affected build, any other route to local code execution on these appliances leads to the same root result.

TSGA and TSProxy: Built for Check Point

TSGA is a standalone passive Linux backdoor written specifically for Check Point appliances. It provides encrypted remote access, steals configuration, survives through backup and snapshot persistence, injects into processes, and tampers with binary firewall logs. That last capability matters most for defenders: the device that is supposed to record the intrusion can be made to hide it.

TSProxy is a library that TSGA injects into selected appliance processes. It hooks networking functions so that connections carrying the attacker's marker go to the implant, while normal traffic passes through as usual. In Check Point's words, this pairs "a persistent standalone backdoor with concealed access through existing appliance services." The attacker gets no new listening port to find, only legitimate services that quietly respond to a second set of clients.

From Firewall to Hypervisor

Once root on the gateway, the attackers ran the gogo scanner to map the internal network, then moved over SSH to a VMware ESXi host by logging in as vpxuser, the account vCenter uses to manage ESXi. There they staged destroy_v6, a Linux ELF wiper that walks the target directory recursively, tries to overwrite each file with zeros, and deletes everything regardless of file extension. Each directory it processed got a DREAM_ANNEXATION.txt note with political content tied to the Israeli-Palestinian conflict.

The destructive stage hit some of the organizations from the first, Israel-focused wave. Wiping a hypervisor takes out every guest VM on it at once, which explains why the attackers went after ESXi instead of individual servers.

Attribution Is Unresolved

TSGA and TSProxy are assessed to be Check Point-specific parts of PhiliKit, a toolkit ESET documented in June 2026 and attributed to Armory Castle, the China-nexus espionage group formerly tracked as UNC5221. Other clues fit a China-aligned operator: LightNode VPS infrastructure, and scanning concentrated between 12 and 9 a.m. UTC, which lines up with Chinese working hours.

Check Point still declines to attribute the campaign. Wipers and Israel-focused political messaging do not fit the known behavior of Armory Castle or other China-nexus espionage groups. The company lists several possibilities: the identified actor ran the whole operation, acted only as an initial access broker, or took part in a false flag. It also notes the destruction may have been a smoke screen to cover the espionage.

Vendor Fix and Federal Deadline

Check Point has released fixes for the PHP2Shell flaws and for CVE-2026-123039 across the affected R81 and R82 branches, and has published the technical details and indicators, including 130.94.19[.]204, the slot_CPconfigdaemon implant name, the destroy_v6 wiper, and the DREAM_ANNEXATION.txt note. CISA's KEV listing requires federal civilian agencies to remediate CVE-2026-123039 by November 16, 2026. Patching blocks new compromises. Gateways exposed during the window need a compromise assessment, because TSGA was designed to persist through backups and snapshots.

RedEye Security can assess whether your Check Point estate and connected virtualization infrastructure show signs of this campaign. Contact our team for a compromise assessment.