Check Point said unknown attackers began exploiting unpatched Security Gateways on Oct. 30, 2026, using PHP2Shell flaws for initial access, then a local Gaia OS privilege-escalation bug to plant a backdoor and, in some Israeli cases, wipe files on VMware ESXi hosts^1,2.

The company said the first wave hit Israeli organizations through vulnerable Mobile Access portals, with evidence of successful compromise in some cases^1,2. A second wave on Nov. 2 targeted some of those same organizations plus others in multiple countries and sectors, without a clear geographic or industry pattern^1,2.

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, critical PHP bugs that allow unauthenticated remote code execution^1,2. BleepingComputer noted PHP issued emergency patches on Oct. 21 and that earlier reporting had placed exploitation attempts days before those fixes². Check Point said the late-October gateway activity came about a week after a security fix was available and originated from 130.94.19.204¹.

After portal access, Check Point said the attackers used CVE-2026-123039, a missing-authorization issue in the DynamicCLI process rated 7.8 on the CVSS scale, to escalate from a portal service account to root^1,2. The firm said the bug needs local code execution already on the appliance and that it had seen active exploitation against a couple of dozen customers¹. Affected versions listed include R82.20, R82.10, R82, R81.20, R81.10, and R81¹.

Operators then installed PHP web shells that run commands and upload files, plus a persistent backdoor Check Point calls TSGA, deployed as slot_CPconfigdaemon, with an embedded TSProxy component that intercepts networking functions to hide attacker connections in ordinary traffic^1,2.

In some first-wave Israeli incidents, Check Point said the attackers ran the gogo scanner from the gateway, moved over SSH to an ESXi host using the vpxuser account, staged a Linux ELF wiper named destroy_v6, and left notes named DREAM_ANNEXATION.txt^1,2. The wiper recursively deletes files after attempting to overwrite them with zeros¹. BleepingComputer said the Nov. 2 wave did not include that destructive stage, and that later actions remain unclear².

The Hacker News said TSGA and TSProxy overlap with a Check Point-specific toolkit ESET documented in June 2026 as PhiliKit and linked to a China-nexus group, while the wiper notes referenced the Israeli-Palestinian conflict¹. Check Point said the evidence does not support a high-confidence judgment: one actor, an initial-access broker, a false-flag operation, or destructive activity as a smoke screen all remain possible^1,2.

Check Point told customers to install the November Jumbo Hotfix on Management Servers and Security Gateways, especially those with internet-facing Mobile Access portals, and to look for session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, and unexplained gaps in firewall logs².