Attackers exploit Check Point flaw to wipe gateway systems

Check Point gateways that had not been patched were compromised starting 30 October 2026, with attackers exploiting the Mobile Access portal to gain initial access via PHP2Shell, according to Check Point Research. The operation escalated to root privileges through CVE-2026-123039, a local privilege‑escalation flaw in the DynamicCLI IPC interface, enabling the attackers to deploy PHP webshells and establish persistence.

Evidence cited includes PHP session files in /opt/CPcvpn-R81.20/tmp/ and crashes in Apache and PHP processes, suggesting repeated exploitation attempts. The incidents were observed as two waves: the first on 30 October affecting Israeli organisations with some destructive activity, and a second on 2 November affecting organisations in several countries with no evident destruction, implying opportunistic scanning rather than targeted action.

After gaining root, the attackers placed PHP webshells in the portal’s login area (files named starting with zz and ending in .tpl), later upgrading to more capable versions that required a hardcoded key and supported file uploads and PHP code execution. A separate backdoor, TSGA, was launched from /tmp/CPconfigdaemon, restarted as slot_CPconfigdaemon, and paired with TSProxy at /lib/libcpfwcommon.so to enable encrypted remote access, configuration theft, persistence, process injection and log tampering.

From the gateway, the operators used the gogo scanner to map the internal network, then moved via SSH to a VMware ESXi host using the vpxuser account to stage a Linux wiper, destroy_v6, which overwrites files and leaves a Hebrew note titled DREAM_ANNEXATION.txt in each folder. Check Point researchers note that the tools resemble PhiliKit and UNC5221 activity, but final attribution remains uncertain, with multiple plausible explanations and no single confirmed actor.