--- title: PHP2Shell attacks on unpatched Check Point gateways led... description: Attackers exploited unpatched Check Point Security Gateways through vulnerable Mobile Access portals, with activity starting October 30, 2026. They escalated... canonical: https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP2Shell attacks on unpatched Check Point gateways led to root access, a backdoor and an ESXi wiper | daily.dev og:description: Attackers exploited unpatched Check Point Security Gateways through vulnerable Mobile Access portals, with activity starting October 30, 2026. They escalated... og:url: https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj og:image: https://api.daily.dev/og/posts/U6G8QAYZJ.png og:image:alt: PHP2Shell attacks on unpatched Check Point gateways led to root access, a backdoor and an ESXi wiper og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP2Shell attacks on unpatched Check Point gateways led to root access, a backdoor and an ESXi wiper **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Attackers exploited unpatched Check Point Security Gateways through vulnerable Mobile Access portals, with activity starting October 30, 2026. They escalated to root using CVE-2026-123039 in the DynamicCLI interface, then dropped PHP webshells and a persistent backdoor called TSGA with its networking component TSProxy. A first wave hit Israeli organizations and included a wiper, destroy_v6, run against an ESXi host via SSH, leaving a political note. A second, broader wave on November 2 hit multiple countries without destructive activity. TSGA and TSProxy are modified variants of PhiliKit, previously tied to Ivanti exploitation. Check Point Research called it 'Chinese malware, Israeli targets, wiper deployment', though attribution remains uncertain. Fix: patch Mobile Access and DynamicCLI, check for PHP files and SSH activity to ESXi hosts. ## Content Attackers broke into unpatched Check Point Security Gateways through vulnerable Mobile Access portals, with the first activity starting October 30, 2026. From there they escalated to root using CVE-2026-123039 in the DynamicCLI interface. Once they had root, they dropped PHP webshells and installed a persistent backdoor called TSGA, along with its networking component, TSProxy. ## Two waves The first wave hit Israeli organizations and included destructive activity. In at least one case the attackers pivoted over SSH to a VMware ESXi host and ran a wiper called destroy_v6, leaving behind a politically themed note. A second, broader wave came on November 2. It reached organizations in multiple countries, and this time nothing was destroyed. ## Tooling and attribution TSGA and TSProxy are modified variants of PhiliKit, a framework previously documented in attacks that exploited Ivanti vulnerabilities. Check Point Research summed it up as "Chinese malware, Israeli targets, wiper deployment", and @hasherezade passed that along. Attribution is still uncertain, though. Reused tooling points somewhere, but it doesn't settle who is behind this. The odd part is the mix: a framework tied to earlier espionage-style intrusions, now paired with a wiper and a political message. Whether that reflects one actor changing goals or tools being shared is an open question. ## What to do The entry point was unpatched gateways, so patching the Mobile Access and DynamicCLI issues is the obvious first step. Anyone running these gateways should also check for unexpected PHP files and look at SSH activity toward ESXi hosts. ## Questions this post answers ### What is CVE-2026-123039 in Check Point gateways? CVE-2026-123039 is a vulnerability in the DynamicCLI interface of Check Point Security Gateways that attackers used to escalate from an initial foothold in the Mobile Access portal to root access. Once attackers had root, they dropped PHP webshells and installed a persistent backdoor called TSGA along with its networking component, TSProxy. _Teams tracking gateway CVEs and patch priorities follow writeups like this on daily.dev._ ### What is the TSGA backdoor and how is it related to PhiliKit? TSGA, along with its networking component TSProxy, is a modified variant of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Attackers installed TSGA after gaining root on compromised Check Point gateways through the DynamicCLI vulnerability, then used it to maintain persistent access. _Defenders mapping backdoor families across vendors can keep up with cases like this on daily.dev._ ### What wiper malware was used against ESXi hosts in the Check Point gateway attacks? Attackers used a wiper called destroy_v6 against at least one VMware ESXi host, reached by pivoting over SSH from a compromised Check Point gateway. The attack left behind a politically themed note, and occurred during the first wave of the campaign, which specifically targeted Israeli organizations. _Admins hardening ESXi and SSH exposure can follow incident details like this on daily.dev._ ## Similar posts on daily.dev - [PHP2Shell: Why One PHP Vulnerability Put Much of the Web on Emergency Patch Mode](https://daily.dev/posts/php2shell-why-one-php-vulnerability-put-much-of-the-web-on-emergency-patch-mode-gllstobba) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHP2Shell attacks on unpatched Check Point gateways led to root access, a backdoor and an ESXi wiper","url":"https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj"},"datePublished":"2026-11-12T15:58:14.983Z","dateModified":"2026-11-12T15:58:57.313Z","description":"Attackers exploited unpatched Check Point Security Gateways through vulnerable Mobile Access portals, with activity starting October 30, 2026. They escalated...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"PHP2Shell attacks on unpatched Check Point gateways led to root access, a backdoor and an ESXi wiper"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php2shell-attacks-on-unpatched-check-point-gateways-led-to-root-access-a-backdoor-and-an-esxi-wiper-u6g8qayzj#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-123039 in Check Point gateways?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-123039 is a vulnerability in the DynamicCLI interface of Check Point Security Gateways that attackers used to escalate from an initial foothold in the Mobile Access portal to root access. Once attackers had root, they dropped PHP webshells and installed a persistent backdoor called TSGA along with its networking component, TSProxy. Teams tracking gateway CVEs and patch priorities follow writeups like this on daily.dev."}},{"@type":"Question","name":"What is the TSGA backdoor and how is it related to PhiliKit?","acceptedAnswer":{"@type":"Answer","text":"TSGA, along with its networking component TSProxy, is a modified variant of PhiliKit, a framework previously documented in attacks exploiting Ivanti vulnerabilities. Attackers installed TSGA after gaining root on compromised Check Point gateways through the DynamicCLI vulnerability, then used it to maintain persistent access. Defenders mapping backdoor families across vendors can keep up with cases like this on daily.dev."}},{"@type":"Question","name":"What wiper malware was used against ESXi hosts in the Check Point gateway attacks?","acceptedAnswer":{"@type":"Answer","text":"Attackers used a wiper called destroy_v6 against at least one VMware ESXi host, reached by pivoting over SSH from a compromised Check Point gateway. The attack left behind a politically themed note, and occurred during the first wave of the campaign, which specifically targeted Israeli organizations. Admins hardening ESXi and SSH exposure can follow incident details like this on daily.dev."}}]} ```