Recent attacks have spotlighted the exploitation of PHP2Shell vulnerabilities on Check Point Gateway appliances. These vulnerabilities have been utilized by threat actors to deploy destructive malware, according to reports from Check Point.
Initial and Subsequent Attack Waves
The attacks were executed in two distinct phases, with the first wave commencing on October 30, primarily impacting Israeli organizations. A second wave followed on November 2, extending the reach to multiple countries.
PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, presents critical vulnerabilities that enable remote code execution, affecting all PHP versions from PHP 5 onwards. Despite patches being released on October 21, exploitation began just before and surged shortly thereafter.
Link to Chinese Hackers and Attack Methodology
The attacks have been tentatively linked to Chinese hackers by Dream Security, who noted a connection through similar methods used on Palo Alto Networks firewalls. During the Check Point incidents, attackers initially exploited PHP2Shell for access, then leveraged CVE-2026-123039, a local privilege escalation, to gain root access and establish persistence using PHP webshells.
In late October, attackers focused on Check Point Mobile Access gateways, embedding PHP webshells within directories used for login pages, facilitating command execution and deeper infiltration.
Malware Deployment and Attack Characteristics
Subsequently, they deployed malware variants TSGA and TSProxy, linked to the PhiliKit framework, previously associated with Chinese group UNC5221. This enabled backdoor access and manipulation of network functions.
Further actions included internal asset reconnaissance, lateral movement to VMware ESXi hosts, and the execution of a wiper, accompanied by notes referencing Dream Security. Although operations coincided with Chinese business hours, the destructive nature of the attacks diverges from typical Chinese cyber operations.
Check Point acknowledges multiple plausible scenarios regarding the attackers’ intentions, including potential false-flag operations or diversionary tactics.
Global Impact and Future Implications
The second attack wave targeted Check Point Security Gateways globally, including previously impacted Israeli entities. Unlike the first wave, no destructive activities were observed in this phase, suggesting a shift in strategy.
Check Point’s analysis indicates no specific sector focus, implying opportunistic targeting rather than strategic sector-specific threats. This underscores the ongoing need for vigilance and robust cybersecurity measures across all sectors.
