Hackers exploit PHP2Shell vulnerabilities in Check Point gateways and deploy TSGA backdoor

PHP2Shell vulnerabilities and privilege escalation

An as-yet-unidentified threat actor has been exploiting two flaws in Check Point Security gateways. The first, known as PHP2Shell, allows initial access to the device through a vulnerable web service. The second, CVE-2026-123039, is an authorization bug that grants privilege escalation to the DynamicCLI process, enabling elevation to the root user after local code execution.

Attack campaign and targets

According to the Check Point report, the campaign began on October 30, 2026, initially focusing on Israeli organizations. A second wave on November 2 expanded the target to entities in various countries and sectors, with no apparent geographic or sectoral pattern. In both phases, the attacker reportedly used IP addresses from the 130.94.19[.]204 range to exploit the vulnerable gateways.

TSGA backdoor and TSProxy component

After gaining access via PHP2Shell, the attacker escalated privileges with CVE-2026-123039 and deployed persistent PHP shells. On top of these shells, the TSGA backdoor was installed, identified as "slot_CPconfigdaemon". TSGA includes an additional module called TSProxy, which injects code into appliance processes to intercept marked connections, allowing encrypted remote access, configuration theft, persistence via snapshots, and firewall log manipulation.

Use of destroy_v6 wiper and political messages

Two days after the initial breach, the group moved laterally to VMware ESXi hosts via SSH, authenticating with the vpxuser service account. On ESXi, the "destroy_v6" file destroyer was deployed, an ELF wiper that scans directories, overwrites files with zeros, and deletes them. In each affected directory, the malware left a text file titled "DREAM_ANNEXATION.txt", containing political messages related to the Israeli-Palestinian conflict.

Relations with threat groups and uncertainties

The TSGA backdoor and TSProxy have been associated with the "PhiliKit" toolset, first documented by ESET in June 2026 and attributed to the Chinese cyber espionage group "Armory Castle" (formerly UNC5221). Indicators such as LightNode VPS infrastructure and scanning hours between 12:00 and 09:00 UTC reinforce the hypothesis of Chinese involvement, although Check Point stresses that there is no conclusive evidence to confirm authorship.

Practical recommendations for administrators

Organizations using the listed Check Point products (Force Firewalls, Management and Log Servers, Multi-Domain Security Management, Maestro Orchestrator) in versions R81 to R82.20 must immediately apply the patches released in October 2026. In addition, it is recommended to:

• Disable or restrict the web service that exposes PHP2Shell.

• Check for the presence of unauthorized DynamicCLI sockets and remove any suspicious configuration files.

• Audit service accounts, especially vpxuser, and revoke unused credentials.

• Monitor SSH logs for ESXi access attempts from external IP addresses.

• Implement detections for the creation of "destroy_v6" files and "DREAM_ANNEXION.txt" texts.

CyberX Technical Analysis

The initial vector is based on exploiting the PHP2Shell vulnerability, which allows arbitrary command execution via a malformed HTTP request. Once inside, the attacker obtains service credentials that grant access to the DynamicCLI process. CVE-2026-123039, classified with a CVSS of 7.8 (according to Check Point's advisory), allows an authenticated user to write directly to the DynamicCLI socket, resulting in escalation to root.

With administrator privileges, the attacker installs persistent PHP shells and then the TSGA backdoor. TSProxy works as a network hook that intercepts socket calls, redirecting flagged traffic to encrypted channels controlled by the attacker without interrupting the legitimate flow. This technique makes detection by standard traffic inspection tools difficult.

Lateral movement to ESXi occurs via SSH using the vpxuser service account, which, according to VMware documentation, has host management permissions. The destroy_v6 wiper, written in Linux ELF, executes a file-overwriting algorithm (zero-fill) prior to deletion, making recovery extremely difficult.

Confirmed impacts include total data loss in target directories and compromise of firewall log integrity, which can hide subsequent activities. Confidentiality is also affected, as TSGA allows the exfiltration of configurations and credentials.

Mitigations recommended by CyberX:

• Apply official patches for PHP2Shell (CVE-2026-109618, CVE-2026-109619) and CVE-2026-123039.

• Isolate the vulnerable web service on a separate VLAN and restrict access to trusted IPs.

• Enable multi-factor authentication for privileged service accounts.

• Implement integrity monitoring for critical files (/etc/dynamiccli.socket, gateway binaries).

• Use EDR solutions that detect library injection via TSProxy.

SOC Bulletin

An active campaign is exploiting vulnerabilities in Check Point gateways. Potentially affected assets are:

• Check Point ForceFirewalls, Management/Log Servers, Multi-Domain Security Management, and Maestro Orchestrator in versions R81, R81.10, R81.20, R82, R82.10, and R82.20.

Exposure conditions:

• Web service exposed to the internet without IP restriction.

• Presence of service accounts with SSH permissions for ESXi.

Observed techniques (MITRE ATT&CK):

• Initial Access – Exploit Public-Facing Application (T1190) – PHP2Shell.

• Privilege Escalation – Exploitation for Privilege Escalation (T1068) – CVE-2026-123039.

• Persistence – Web Shell (T1100) – PHP shells.

• Defense Evasion – Modify Registry/Configuration (T1112) – TSProxy injection.

• Impact – Data Destruction (T1485) – destroy_v6 wiper.

Confirmed Indicators of Compromise (IoCs):

• Source IP address: 130.94.19.204.

• Wiper filename: destroy_v6.

• Political note file: DREAM_ANNEXION.txt.

• Backdoor process: slot_CPconfigdaemon.

Monitoring recommendations:

• Alert for unauthorized creation of DynamicCLI sockets.

• Detect uploads of ELF files named "destroy_v6".

• Correlate SSH login attempts to ESXi from external addresses.

Official fixes:

• Security patches released in October 2026 for the cited vulnerabilities.

Immediate actions:

• Apply patches to vulnerable gateways.

• Block HTTP traffic to the PHP2Shell service from the internet.

• Review and revoke non-essential service credentials.

Long-term controls:

• Implement network segmentation for security appliances.

• Adopt continuous monitoring of critical file integrity.

• Conduct periodic risk assessments focused on management components.

Frequently Asked Questions