PHP2Shell Exploited in Destructive Check Point Gateway Attacks

Check Point is warning customers that threat actors are actively exploiting PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619, which impact the vendor’s security gateway devices.

Exploitations begin by attacking internet-facing Mobile Access portals that result in crashes of Apache and PHP worker processes.

CVE-2026-109618 is a memory corruption vulnerability caused by incorrect cleanup of requests, while CVE-2026-109619 is a use-after-free bug found in PHP’s session upload progress feature.

Check Point Research tracked two exploitation waves starting October 30 and November 2.

Achieving unauthenticated code execution as a restricted service account, assailants escalate their privileges to root on vulnerable systems using the Gaia OS DynamicCLI CVE-2026-123039 bug.

When they take over the gateway as root, the adversaries deploy PHP shells alongside TSGA backdoors and TSProxy tools for network access. They also use names like “upload_progress_pwn” in PHP session file contents to mark their presence on the victim machine.

Wiper attacks hit internal ESXi hosts

On Oct. 30, attackers who had already gained access to an enterprise network through a compromised network appliance via SSH used that foothold to move laterally into the internal infrastructure and gain control of VMware ESXi servers.

Hackers behind the attack executed a destructive wiper dubbed destroy_v6 and deployed files with politically-themed names such as DREAM_ANNEXATION.txt.

The second wave of attacks, which arrived in early November, had a wider reach beyond the initial targets, and instead of erasing systems, it used them to deploy backdoors.

Patches are already out.

The flaw was fixed by PHP in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Check Point issued hotfixes to remediate CVE-2026-123039 (Gaia OS).

Defenders should check for /opt/, as well as temporary directories, for suspicious or unknown files, SSH keys, and outbound traffic originating from gateways.