Check Point Gateways Hit by Wiper Attacks Chaining PHP2Shell and New Zero-Day

Key points

• Initial access was achieved via PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on Mobile Access portals, followed by privilege escalation using CVE-2026-123039.
• The first wave on October 30 targeted Israeli organizations and included the deployment of the destroy_v6 wiper and TSGA backdoor; a second wave on November 2 targeted multiple countries without destructive activity.
• CISA added CVE-2026-123039 to the KEV catalog on November 13, with a patch deadline of November 16 for US federal agencies.
• Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals.
• Attribution is uncertain; while tools resemble those linked to Chinese-nexus group UNC5221, the destructive nature and political notes suggest possible false-flag or retaliatory motives.

Background

This incident follows earlier coverage of Check Point gateway compromises in late October 2026, where similar TSGA backdoor and wiper malware were reported. The current campaign highlights the rapid exploitation of newly patched vulnerabilities, specifically PHP2Shell, which was fixed by PHP on October 21 but exploited starting October 25. The broader context includes CISA’s ongoing efforts to track exploited vulnerabilities, with previous Check Point flaws added to the KEV catalog in September 2026.

How outlets are covering it

Check Point Research emphasizes the technical chain of exploitation, noting that while the TSGA and TSProxy tools share lineage with PhiliKit (linked to UNC5221), the destructive wiper activity and Hebrew political notes contradict typical Chinese-nexus espionage motives. They suggest the actor may have acted as an initial access broker or participated in a false-flag operation. The Hacker News focuses on the urgency of patching CVE-2026-123039, highlighting its CVSS score of 7.8 and the fact that it was exploited against a 'couple of dozen' customers. Rescana provides detailed technical mitigation steps, stressing that patching does not undo existing compromises and urging organizations to check for specific indicators of compromise, such as upload_progress_pwn session files and CPconfigdaemon processes. BleepingComputer summarizes the overall threat landscape, noting that CISA warned of attackers chaining PHP2Shell with the Fragnesia Linux kernel flaw, though the primary focus here is the Check Point-specific exploitation.

Why it matters

The exploitation of Check Point Security Gateways poses a significant risk to network perimeter security, as these devices often hold critical VPN and firewall configurations. The use of a wiper malware indicates a shift from espionage to destructive intent, potentially causing operational disruption. The rapid addition of CVE-2026-123039 to the CISA KEV catalog underscores the severity of the privilege escalation flaw, which allows root access if initial access is achieved. Organizations that failed to patch PHP2Shell by late October are at high risk of compromise, and the presence of backdoors like TSGA could lead to long-term persistent access and data theft or destruction. Immediate patching and forensic investigation are critical to mitigate these risks.

What to watch

Organizations must install the November Jumbo Hotfix on all Check Point Management Servers and Security Gateways, prioritizing those with internet-facing Mobile Access portals. Administrators should investigate previously exposed gateways for signs of compromise, including session files containing upload_progress_pwn, unexpected CPconfigdaemon processes, and gaps in firewall logs. CISA requires US federal agencies to patch CVE-2026-123039 by November 16. Check Point will likely continue monitoring for further exploitation attempts and may update attribution assessments as more evidence emerges. The Canadian Centre for Cyber Security has also issued advisory AV26-1154, indicating international attention to this threat.