Check Point Gateway Attacks Reached VMware ESXi: Patch and Hunt Now

Check Point has released a new round of Jumbo Hotfixes after investigating attacks that chained the leaked PHP2Shell flaws with a previously undisclosed Gaia OS privilege-escalation bug, then moved from compromised security gateways into internal VMware infrastructure.

The campaign began on October 30, 2026, according to Check Point Research’s technical report. Attackers exploited internet-facing Mobile Access portals, elevated from the portal service account to root through CVE-2026-123039, installed webshells and a persistent backdoor, and scanned internal networks. In at least one investigated incident, they authenticated to a VMware ESXi host over SSH and ran a destructive wiper.

A broader second wave followed on November 2, reaching organizations in multiple countries and sectors. Check Point found no destructive activity in that wave, but its advisory says only the absence of observed destruction, not the absence of compromise. The company is urging customers to install the November Jumbo Hotfix across both management servers and security gateways, with internet-facing Mobile Access systems first.

How the Check Point attack chain worked

The initial foothold used CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities known collectively as PHP2Shell. On affected Check Point gateways, those flaws exposed firewall web interfaces to remote code execution. TechsCurrent’s earlier PHP2Shell patch guide covers the wider PHP risk; this campaign shows what attackers did after reaching a perimeter appliance.

CVE-2026-123039 supplied the next step. The Gaia OS DynamicCLI daemon runs as root and accepts commands through a local socket that was writable without adequate authentication. A low-privileged local process could therefore submit commands that executed with root authority. Check Point rates the flaw 7.8, but that score describes the local escalation in isolation. Chained after an internet-facing PHP compromise, it gave the attacker full control of the gateway.

Root access was used to place PHP webshells in the template directory used to build Mobile Access login pages. The attacker also deployed TSGA, a backdoor that injects a companion component called TSProxy into appliance processes. That design let specially marked connections reach the backdoor through existing services while normal traffic continued, making the implant less conspicuous than a new listening port.

The ESXi wiper stage

After deploying the backdoor, the attackers ran the gogo scanner from the gateway to identify internal services. In the documented destructive intrusion, they reached a VMware ESXi host over SSH using the vpxuser service account. That detail makes credential and trust review as important as patching the appliance: it indicates the gateway held or could reach credentials that worked farther inside the environment.

The attacker staged a Linux binary named destroy_v6 under /tmp on the ESXi host. Check Point’s analysis says the program recursively deleted files in a target directory. A note named DREAM_ANNEXATION.txt was left behind without a payment demand, and the first wave included politically themed destructive activity against Israeli organizations.

Code and configuration overlap connect TSGA and TSProxy to PhiliKit, a framework previously observed in attacks against Ivanti appliances. Check Point notes that earlier research associated PhiliKit with a China-linked cluster, but it does not attribute this campaign. The evidence could also fit an initial-access broker, shared tooling, or an effort to disguise the operator.

Which Check Point systems need the hotfix

Check Point’s advisory lists Gaia releases R81.20, R82, R82.10 and R82.20 as affected by CVE-2026-123039. The vendor recommends the November Jumbo Hotfix for all management servers and security gateways rather than treating the DynamicCLI patch as a gateway-only task.

Published release notes show the relevant fixes in R81.20 Take 174, R82 Take 132 and R82.20 Take 14. Administrators should use the vendor’s current support article and CPUSE catalog for the matching R82.10 package and any release-specific prerequisites.

CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13. The federal remediation deadline is November 16, an unusually short window that reflects confirmed exploitation and the need to perform forensic triage, not simply deploy a patch.

What defenders should check now

1. Preserve evidence before rebooting or rebuilding. Collect system, Mobile Access, process and traffic logs from gateways and central logging systems. Export volatile process and network information if the appliance is stable enough to do so.
2. Search for PHP2Shell artifacts. Check PHP session files under /opt/CPcvpn-R81.20/tmp/ and equivalent release paths for upload_progress_pwn. A burst of Apache or PHP segmentation faults during the attack window is another useful signal.
3. Hunt for persistence. Investigate binaries or processes named like CPconfigdaemon, unexpected PHP files in Mobile Access template directories, unfamiliar injected libraries, and unexplained connections through established appliance services.
4. Review traffic from the reported scanners. Check for connections involving 130.94.19[.]204 and 130.94.19[.]168. A match is a lead, not proof; a miss does not clear the system because infrastructure can change.
5. Look beyond the gateway. Review outbound SSH from Check Point appliances, ESXi authentication involving vpxuser, new files under /tmp or /temp, tools containing scanner or wiper, and the DREAM_ANNEXATION.txt filename.
6. Treat logging gaps as evidence. Check Point observed unexplained gaps in firewall traffic logs after logging-daemon crashes. Do not read missing records as proof that no activity occurred.
7. Rotate reachable credentials and trust. If a gateway may have been compromised, rotate service credentials, API keys, SSH material and administrative secrets available from it. Review management-plane trust and remove unnecessary SSH paths to hypervisors.

Patching is the start of the response

The November hotfix closes the PHP2Shell and DynamicCLI paths identified in this chain, but it does not remove a webshell, TSGA implant or stolen credential already present in the environment. Any gateway showing the reported artifacts should be isolated and handled as a root-level compromise. Recovery should include a vendor-supported clean rebuild, validation of management servers and policies, credential rotation, and a search across the networks the appliance could reach.

That broader scope is justified by the campaign’s sequence: an exposed portal became root access on a trusted network control point, which then became an internal scanner and a route to the virtualization layer. A green hotfix status answers whether the known vulnerabilities are closed. It does not answer whether the attacker got there first.