In a report published on 13 November 2026, researchers detailed an attack campaign where threat actors actively exploited PHP2Shell vulnerabilities and a Gaia OS privilege escalation flaw in Check Point Security Gateways. Initial attacks began on 30 October 2026, targeting Israeli organizations, before a broad follow-up attack wave occurred on 2 November 2026 targeting organizations across multiple countries and sectors. Check Point observed active exploitation of these security issues against a couple of dozen customers.

The malicious activity leverages critical software vulnerabilities to gain unauthorized initial access and subsequently escalate privileges within affected enterprise environments. Attackers combined the initial gateway entry methods with advanced pivoting techniques to reach secondary infrastructure, demonstrating a coordinated approach to target both perimeter networking equipment and internal virtualization layers.

Specifically, the campaign utilizes PHP2Shell flaws tracked as CVE-2026-109618 and CVE-2026-109619 to target Mobile Access portals on Check Point Security Gateways. Additionally, actors abused CVE-2026-123039, a missing authorization flaw in the DynamicCLI interface of Gaia OS that permits local root privilege escalation. The impacted product versions include R82.20, R82.10, R82, R81.20, R81.10, and R81.

Following the successful exploitation of the gateway appliances, attackers deployed PHP web shells alongside the TSGA persistent backdoor and TSProxy. From the compromised network perimeter, the threat actors pivoted directly to internal VMware ESXi hosts. On these hypervisor systems, they deployed the destroy_v6 wiper and left behind text notes titled DREAM_ANNEXATION.txt to mark their destructive actions.

The impact of this multi-stage campaign is severe for affected organizations, as it bridges perimeter security device compromises with the destruction of vital virtual machine environments. Despite the detailed technical findings gathered during the investigation, Check Point noted that there is currently insufficient evidence to definitively confirm attribution of the campaign to a specific threat group.

To address these risks, administrators should apply relevant security fixes and properly secure Mobile Access portals against unauthorized entry. Maintaining rigorous patch management practices across both network appliances and virtualization hosts remains essential for defending enterprise networks against evolving multi-layered intrusion tactics.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news