THE CRUNCH
Attackers have been exploiting the PHP2Shell vulnerabilities to break into Check Point gateway appliances and deploy a wiper, software designed to destroy data, Check Point reports. The campaign unfolded in two waves: a destructive round starting on October 30 that targeted Israeli organisations, and a second wave from November 2 aimed at organisations in multiple countries, with no destructive activity observed in the second wave.
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, covers two critical flaws that allow remote code execution on PHP versions from PHP 5 onwards. The patches arrived on October 21, but exploitation began days before the fixes and mass exploitation followed shortly after.
In the Check Point campaign, the attackers used PHP2Shell for initial access, then chained a local privilege escalation flaw in the DynamicCLI process, CVE-2026-123039, to gain root access. They planted PHP webshells in a directory the Mobile Access portal uses to build login pages, then deployed TSGA and TSProxy, variants of the PhiliKit malware framework previously linked to China-nexus actor UNC5221's intrusions into Ivanti products.
After internal asset discovery and lateral movement, the attackers reached a VMware ESXi host, executed the wiper and left a note mentioning security firm Dream Security. Dream has separately linked PHP2Shell attacks that rooted Palo Alto Networks firewalls to Chinese hackers, and Check Point notes the hackers operated during typical Chinese working hours.
Check Point cautions that the attribution is far from settled: the destructive wiper and the overall nature of the attacks do not match known Chinese operations, and scenarios including an initial access broker or a false-flag operation remain plausible. Neither wave showed a clear sector preference, which the company reads as opportunistic access attempts rather than sector-specific targeting.