PHP2Shell Hits Check Point Gateways: How Attackers Pivoted From VPN Portals to Wiping ESXi Hosts

By Carl Ballenger, CISSP, CCSP | CarlsCloud (carlscloud.com)

When the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) dropped in late October 2026 (The Hacker News), most teams immediately hunted for exposed Apache and Nginx web servers. The catch? Embedded PHP hides inside plenty of enterprise network appliances, too—and attackers know it.

Starting October 30, 2026, threat actors began exploiting unpatched Check Point Security Gateways through their Mobile Access portals, chaining PHP2Shell with a newly disclosed Gaia OS privilege escalation flaw (CVE-2026-123039) to gain root access, plant stealthy backdoors, and wipe internal VMware ESXi hosts (The Hacker News).

Here is the plain-English breakdown of what happened and how it would map to your CISSP and CCSP exam prep.

The Technical Breakdown: What Happened and Why It Matters

Attackers didn't need a complex zero-day chain to pull this off. They waited roughly one week after a security fix became available, scanned for unpatched appliances, and walked right through the front door (The Hacker News):

Breaking in through Mobile Access portals

Attackers hit vulnerable Mobile Access portals on Check Point Security Gateways using the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), first targeting Israeli organizations on October 30 before launching an opportunistic global wave on November 2 (The Hacker News).

Escalating to root via Gaia OS (CVE-2026-123039)

Once on the gateway as the portal service account, attackers exploited CVE-2026-123039 (CVSS 7.8)—a missing authorization check in the DynamicCLI process—to run arbitrary commands as root across versions R81 through R82.20 (The Hacker News).

Planting the TSGA backdoor and hiding in traffic

With root access, they dropped PHP web shells alongside TSGA and TSProxy—Check Point-specific implants tied to the PhiliKit toolkit (previously linked to China-nexus group Armory Castle / UNC5221) (The Hacker News). The malware steals configurations, survives reboots and snapshots, tampers with binary firewall logs, and rides inside legitimate appliance traffic (The Hacker News).

Pivoting to VMware ESXi and wiping files

From the compromised firewall, attackers ran an internal network scanner (gogo), SSH'd into a VMware ESXi hypervisor using the vpxuser service account, and executed a Linux wiper (destroy_v6) that zeroed out files and left political DREAM_ANNEXATION.txt notes—raising questions about whether the wiper was a false flag or a smoke screen to cover espionage (The Hacker News).

Through the CISSP and CCSP Lens: Testable Domain Breakdown

CISSP Domain 4 (Communication and Network Security) & Domain 3 (Security Architecture and Engineering)

Mapping the issue to exam objectives

Turning a perimeter firewall into a launchpad for internal network scanning (The Hacker News) directly tests Zero Trust Architecture (ZTA), Defense in Depth, and Network Segmentation. Affected systems include Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management, and Maestro Orchestrator (The Hacker News).

Applying the Exam Mindset

("Think Like a Manager / Cloud Architect")

Never grant implicit trust to a network appliance just because it sits at the security boundary. On the exam, if a single compromised edge device can freely SSH into your internal virtualization management plane, your internal micro-segmentation and east-west access controls have failed.