[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flX1phojNwKVpf89__UkB1c01mKkDARysgJq64IggduM":3},{"article":4,"iocs":53,"watch_terms":80,"solutions":81,"lesson":176},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"e1b91127-b053-4b1e-8af0-7e26b1f621da","PHP2Shell Exploitation on Check Point Gateway","php2shell-exploitation-on-check-point-gateway-502ecf","By Lotem Finkelstein, VP Research Key findings Introduction We have now confirmed that, in late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways. Evidence suggested some cases of a successful compromise, with exploitation activity consistent […] The post PHP2Shell Exploitation on Check Point Gateway appeared first on Check Point Research.","An attacker exploited unpatched Check Point Security Gateways using PHP2Shell for initial access, followed by privilege escalation via CVE-2026-123039. The attackers deployed webshells, the TSGA backdoor, and TSProxy, then pivoted to a VMware ESXi host to deploy the destroy_v6 wiper and left DREAM_ANNEXATION.txt notes. While ESET associated the PhiliKit framework with China-nexus UNC5221, the evidence does not allow for high confidence in attributing the operation.","Check Point Gateways exploited via PHP2Shell and CVE-2026-123039, leading to malware deployment and wiper activity.","https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002Fphp2shell-exploitation-on-check-point-gateway\u002F","https:\u002F\u002Fresearch.checkpoint.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FPHP2Shell-Exploitation.png","2026-11-12T13:56:37+00:00","2026-11-12T14:00:26.821605+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Check Point Security Gateway","product",{"name":21,"type":19},"VMware ESXi",{"name":23,"type":24},"UNC5221","threat_actor",{"name":26,"type":27},"Check Point","vendor",{"name":29,"type":27},"ESET","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,62,65,67,71,74,77],{"type":55,"value":56,"context":57},"ip","130.94.19.204","Originating IP address for exploitation activity",{"type":59,"value":60,"context":61},"cve","CVE-2026-123039","Local privilege escalation vulnerability in DynamicCLI IPC interface",{"type":59,"value":63,"context":64},"CVE-2026-109618","Associated with PHP2Shell exploitation",{"type":59,"value":66,"context":64},"CVE-2026-109619",{"type":68,"value":69,"context":70},"malware","TSGA","Backdoor deployed by attackers",{"type":68,"value":72,"context":73},"TSProxy","Networking component embedded in TSGA",{"type":68,"value":75,"context":76},"destroy_v6","Wiper malware deployed by attackers",{"type":68,"value":78,"context":79},"PhiliKit","Malware framework used by attackers",[26,29,18],{"controls":82,"vendors":169},[83,111,140],{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":84,"product_name":108,"url":109,"description":110},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":141,"name":142,"problem":143,"products":144},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[170],{"slug":171,"name":26,"logo_path":172,"roles":173},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[174,175],"affected","reported_by",{"slug":177,"title":178,"body":179,"framework_refs":180,"framework_notes":186},"unpatched-check-point-gateways-used-as-pivot-point-for-wiper-deployment","Unpatched Check Point Gateways Used as Pivot Point for Wiper Deployment","Attackers exploited unpatched Check Point Security Gateways — devices that sit at the perimeter and are often trusted implicitly — to gain initial access and then pivot laterally to VMware ESXi hosts where a destructive wiper was deployed. The root cause is a failure to apply available patches to internet-facing network appliances, compounding the risk by allowing the gateway itself to serve as a launchpad deeper into the environment. This attack illustrates that security appliances are high-value targets precisely because they carry elevated trust and network access, yet are frequently overlooked in patching cycles. The deployment of a wiper underscores that delayed detection and inadequate network segmentation can turn an initial intrusion into an irreversible data-destruction event.",[181,182,183,184,185],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1190: Exploit Public-Facing Application","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":187,"NIST SP 800-53 SI-2: Flaw Remediation":188,"NIST SP 800-53 SC-7: Boundary Protection":189,"MITRE ATT&CK T1190: Exploit Public-Facing Application":190,"CIS Control 7: Continuous Vulnerability Management (v8)":191},"This point requires security in acquisition, development, and maintenance including vulnerability handling; a formal vulnerability management process for the gateway appliance would have prevented the initial exploitation.","SI-2 requires timely identification and correction of information system flaws; had this control been enforced, the unpatched CVE exploited for privilege escalation would have been remediated before attackers leveraged it.","SC-7 requires managed interfaces and boundary protection between network segments; stronger boundary controls between the gateway and ESXi management plane would have prevented lateral movement and wiper deployment.","The attackers' initial access via exploitation of the unpatched Check Point gateway directly maps to this technique, highlighting the need for patch management and internet-facing asset hardening.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in internet-facing assets; applying it would have surfaced the unpatched Check Point gateway before attackers exploited it."]