Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5938 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Check Point Mobile Access PHP2Shell Webshell Drop (zz*.tpl / challenge_render.tpl) — Exploitation

Detects the PHP2Shell webshell footprint left by exploitation of Check Point Mobile Access portals (CVE-2026-109618 / CVE-2026-109619): zz<random>.tpl files in the portal templates directory, hardcoded key zz2026, upload staging via /tmp/.up.tpl copied to challenge_render.tpl, PHP session marker upload_progress_pwn, and traffic from the primary attacker IPs 130.94.19.204 / 130.94.19.168. Part of the destroy_v6 wiper campaign.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003, T1027
• Data sources: linux:audit (auditd on Gaia), syslog (Gaia /var/log/messages), Check Point Mobile Access portal
• Severity: critical
• Confidence: high

Splunk SPL

index=linux (sourcetype=linux:audit OR sourcetype=syslog) earliest=-24h ("zz2026" OR "upload_progress_pwn" OR "challenge_render.tpl" OR "/tmp/.up.tpl" OR "130.94.19.204" OR "130.94.19.168" OR (type=PATH name="*/CPcvpn-*" name="*/zz*.tpl")) ```PHP2Shell webshell artifacts on Check Point Mobile Access: zz random tpl drops, hardcoded key zz2026, session marker upload_progress_pwn, staging via .up.tpl copied to challenge_render.tpl```
| eval indicator=case(like(_raw,"%upload_progress_pwn%"),"php_session_marker", like(_raw,"%zz2026%"),"webshell_hardcoded_key", like(_raw,"%challenge_render.tpl%"),"challenge_render_copy", like(_raw,"%/.up.tpl%"),"upload_staging_file", match(_raw,"130\\.94\\.19\\.(204|168)"),"report_attacker_ip", true(),"zz_random_tpl_dropped")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators values(name) as paths by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - count

Microsoft KQL

let AttackerIps = dynamic(["130.94.19.204", "130.94.19.168"]);
let HostHits = Syslog
    | where TimeGenerated > ago(24h)
    | where SyslogMessage matches regex @"zz2026|upload_progress_pwn|challenge_render\.tpl|/tmp/\.up\.tpl|/CPcvpn-[^ ]*/zz[A-Za-z0-9]+\.tpl"
    | extend Indicator = case(
        SyslogMessage contains "upload_progress_pwn", "php_session_marker",
        SyslogMessage contains "zz2026", "webshell_hardcoded_key",
        SyslogMessage contains "challenge_render.tpl", "challenge_render_copy",
        SyslogMessage contains "/tmp/.up.tpl", "upload_staging_file",
        "zz_random_tpl_dropped")
    | project TimeGenerated, Source = "Syslog", Computer, Indicator, Detail = SyslogMessage;
let NetHits = CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceVendor =~ "Check Point"
    | where SourceIP in (AttackerIps) or DestinationIP in (AttackerIps)
    | project TimeGenerated, Source = "CommonSecurityLog", Computer = DeviceName, Indicator = "report_attacker_ip",
        Detail = strcat(SourceIP, " -> ", DestinationIP, ":", tostring(DestinationPort));
union HostHits, NetHits
| order by TimeGenerated desc

Sigma

title: Check Point Mobile Access PHP2Shell Webshell Artifacts
id: 7c1e5a42-3b6d-4f0e-9a21-5d8c0b7e4a11
status: experimental
description: Detects PHP2Shell webshell files dropped in the Check Point Mobile Access templates directory (zz random tpl files, challenge_render.tpl, .up.tpl staging) after exploitation of CVE-2026-109618 and CVE-2026-109619.
references:
    - https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
    - https://support.checkpoint.com/results/sk/sk1000362
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.defense_evasion
    - attack.t1027
    - cve.2026.109618
    - cve.2026.109619
    - cve.2026.123039
logsource:
    product: linux
    service: auditd
detection:
    selection_zz_tpl:
        type: 'PATH'
        name|contains: '/CPcvpn-'
        name|re: '/zz[A-Za-z0-9]+\.tpl$'
    selection_named:
        type: 'PATH'
        name|endswith:
            - '/challenge_render.tpl'
            - '/.up.tpl'
    condition: 1 of selection_*
falsepositives:
    - Check Point support or TAC staging legitimate portal template customisations
    - Administrators uploading custom portal tpl files during maintenance
level: high

Known false positives:

• Check Point support staging legitimate portal template customisations
• Administrators uploading custom .tpl files to the portal during maintenance

Tuning notes: Scope to Gaia hosts running Mobile Access. Enable an auditd watch (-w on the CPcvpn templates directory -p wa) so PATH records exist. Exclude known admin change windows. The attacker IP terms are point-in-time; keep them fresh from SK1000362 and Check Point Research.

• 🔒 TSGA Backdoor Dropper: CPconfigdaemon / [indicator] on Gaia — Post-Exploitation · unlock with TL Creds
• 🔒 TSProxy libcpfwcommon.so Injection on Gaia — Process Injection and Proxying · unlock with TL Creds
• 🔒 ESXi SSH Login as [indicator] From Gateway or Unapproved Host — Lateral Movement · unlock with TL Creds
• 🔒 gogo Scanner Executed on Check Point Gateway — Internal Discovery · unlock with TL Creds
• 🔒 destroy_v6 Wiper Execution and [indicator] Note on ESXi — Impact · unlock with TL Creds
• 🔒 Check Point Firewall Binary Log Tampering (fw1/log) — Defense Evasion · unlock with TL Creds
• 🔒 Check Point Gaia DynamicCLI Local Privilege Escalation (CVE-2026-123039) — Post-Exploitation · unlock with TL Creds
• 🔒 TSGA Backdoor C2: TCP [indicator] and Attacker Infrastructure — C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-5938.

Sample indicators (3 of 33)

• IP address: 130.94.19[.]204
• File hash: edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3
• IP address: 130.94.19[.]168

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

Technical analysis

No actor is named.

Check Point Research (published 2026-11-12) and Check Point advisory SK1000362 describe a campaign against Check Point gateways running R81 through R82.20 (Force Firewalls, Management and Log Servers, Multi-Domain Security Management / Multi-Domain Log Server, and Maestro Orchestrator). Spark Firewalls and Smart-1 Cloud are not affected. Activity began roughly a week after fixes became available. Wave 1 on 2026-10-30 was aimed mainly at Israeli organizations and included destructive activity; portal workers logged hundreds of segfaults. Wave 2 on 2026-11-02 hit organizations in several countries and sectors, with no destructive activity reported.

Initial access is through the Mobile Access portal using PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619 (the same CVE pair is reported by Dream Security in its PHP2Shell research against Palo Alto devices). The primary attacker IP in the Check Point report is 130.94.19.204. The attacker then escalates from the portal service account to root with CVE-2026-123039 (CVSS 7.8). The Gaia dynamic_server process runs as root and accepts commands over /tmp/dynamic_socket, which is world-writable on vulnerable systems and does not verify the submitting user; commands reach a system() sink. The flaw needs prior local code execution and is not a standalone remote flaw.

PHP webshells named <templates>/zz<random>.tpl are dropped in the Mobile Access templates directory, written by a base64-decoded dropper. They are protected by the hardcoded key zz2026 and support OS command execution, PHP evaluation and file upload (staged via /tmp/.up.tpl and copied to challenge_render.tpl); commands can be plain text or Base64/XOR-obfuscated. PHP session files under /opt/CPcvpn-R81.20/tmp/ carry the marker upload_progress_pwn.

The TSGA backdoor is dropped as /tmp/CPconfigdaemon, launched with nohup and output to /tmp/.bd.log, then relocates itself to a boot persistence directory as slot_CPconfigdaemon. It listens on TCP 11072 on all IPv4 interfaces and a Unix socket /tmp/.p_sock, and provides encrypted remote access, PTY shells, Python/Perl execution, file transfer, configuration theft, backup/snapshot persistence, process injection and binary firewall-log tampering. It embeds TSProxy, written to /lib/libcpfwcommon.so and injected into selected appliance processes; it hooks networking functions to handle specially marked attacker connections while passing normal traffic, and provides encrypted SOCKS-style proxying. The open-source gogo scanner (chainreactors/gogo) is used from the gateway for internal discovery, followed by SSH to an ESXi host using the vpxuser service account.

The destroy_v6 Linux ELF wiper takes a target directory, overwrites files with zeros and then deletes them regardless of extension (-f skips the overwrite, -w excludes a pipe-separated directory list). It writes a politically themed Hebrew note, DREAM_ANNEXATION.txt, to each processed directory rejecting ransom negotiation. It was staged on ESXi as /tmp/des wiper.

Attribution is unresolved. TSGA shares Tiny SHell roots, port 11072 and the /tmp/.p_sock socket with PhiliKit, and TSProxy shares operator credentials, transport secrets, activation-selector digests and the TLS certificate/private key with PhiliKit's libdssafe.so. PhiliKit was previously linked by ESET to China-nexus UNC5221 per Check Point, but Check Point found no evidence tying PhiliKit to this incident and notes that the destructive activity, Israel focus and Hebrew note do not fit that profile. Infrastructure is on LightNode VPS (previously associated with China-nexus activity) and scanning concentrated 00:00-09:00 UTC. Tool reuse, an initial access broker, a false flag or destruction as a smoke screen all remain open. The source does not mention CISA KEV listing. Only CVE-2026-123039 has a stated CVSS (7.8); no CVSS is stated for CVE-2026-109618/109619.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021.004 Remote Services: SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information

Discovery

T1046 Network Service Discovery

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1090 Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1561.001 Disk Wipe

Persistence

T1505.003 Server Software Component: Web Shell; T1547 Boot or Logon Autostart Execution

Resource Development

T1583.003 Acquire Infrastructure

Remediation

Patches

• Check Point SK1000362: Jumbo Hotfix Accumulator R82.20 Take 14+, R82.10 Take 52+, R82 Take 132+, R81.20 Take 174+
• After patching, /tmp/dynamic_socket should be srw-rw---- root config (0660)

Immediate actions

• Apply the fixed Jumbo Hotfix Accumulator: R82.20 Take 14, R82.10 Take 52, R82 Take 132 or R81.20 Take 174 (or later)
• Hunt for compromise indicators on all Check Point gateways, management and Maestro hosts before and after patching
• Block 130.94.19.204 and 130.94.19.168 and alert on TCP 11072 listeners on gateways
• Audit vpxuser SSH logins to ESXi hosts, especially from gateway addresses, and review ESXi /tmp for destroy_v6 staging

Workarounds

• Stop dynamic_server and prevent restart with 'dbset process:dynamic_server' then 'dbset :save' (disables Dynamic CLI commands in sk144112); re-enable by setting the process to t and saving
• Search /var/log/dynamicCli.log for 'Rejected connection from unauthorized uid', 'Received = #return_value#', commands lacking the Clish wrapper, and strings such as whoami, /etc/shadow, authorized_keys

Longer-term hardening

• Restrict management-plane and ESXi SSH reachability from perimeter appliances
• Maintain offline, immutable backups of ESXi hosts and datastores given the wiper capability
• Monitor firewall log integrity, since TSGA tampers with binary logs
• Migrate R81 and R81.10 deployments, which are end-of-support with no listed fix

Affected and fixed versions

• Check Point — Gaia OS: Force Firewalls, Management and Log Servers, Multi-Domain Security Management / Multi-Domain Log Server, Maestro Orchestrator (incl. Mobile Access portal)
  Vulnerable versions: R82.20; R82.10; R82; R81.20; R81.10; R81
  Fixed in: R82.20 Jumbo Take 14+; R82.10 Jumbo Take 52+; R82 Jumbo Take 132+; R81.20 Jumbo Take 174+
• Check Point — Spark Firewalls and Smart-1 Cloud (not affected)

Timeline

Last updated 2026-11-13 · 2 updates · revalidated 2× · latest source

• 2026-02-25 A sample named 'philistine' (PhiliKit), whose code overlaps with TSGA/TSProxy, was uploaded to VirusTotal; PhiliKit was later reported in connection with Ivanti VPN exploitation.
• 2026-10-17 First PHP2Shell exploitation attempt observed against an Amazon honeypot, before public disclosure.
• 2026-10-20 Details of CVE-2026-109618/CVE-2026-109619 leaked online.
• 2026-10-21 PHP released fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) and CISA issued an alert; mass exploitation followed.
• 2026-10-24 Honeypots operated by Adel Karimi recorded 35 working shells across three honeypots from two source IPs.
• 2026-10-26 CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog.
• 2026-10-28 CISA adds the Fragnesia kernel flaw (CVE-2026-46300), noted as chainable with PHP2Shell to implant web shells and run commands as root, and the VMware ESX flaw CVE-2026-41709 to the KEV catalog.
• 2026-10-28 Approximate start (about a week after the fix) of Check Point gateway exploitation from locked-ioc-17.
• 2026-10-30 Reporting that a China-linked group chained PHP2Shell with the Fragnesia Linux LPE to root at least 25 Palo Alto firewalls (Dream Security, verified by Unit 42).
• 2026-10-30 Wave 1 begins, mainly against Israeli organizations, with destructive activity against some targets; Mobile Access portal workers log hundreds of segfaults.
• 2026-11-02 Wave 2 hits organizations across several countries and sectors; no destructive activity reported.
• 2026-11-08 Check Point creates advisory SK1000362 for CVE-2026-123039, with Jumbo Hotfix fixes and the dynamic_server workaround.
• 2026-11-12 Check Point Research publishes its PHP2Shell exploitation analysis; SK1000362 is updated the same day.
• 2026-11-13 Cyber Security News reports confirmed exploitation against about two dozen Check Point customers and wiper deployment on VMware ESXi.

Update history

• 2026-11-13 — PHP2Shell Exploitation of Check Point Gateways (CVE-2026-123039) Deploys TSGA Backdoor and destroy_v6 Wiper on ESXi: What changed No severity, exploitability, status or CVSS change; existing values (CRITICAL / ACTIVE / 7.8) already match the newer report. New indicators (1) Indicator values are withheld at this access level.
• 2026-11-13 — PHP2Shell (CVE-2026-109618/CVE-2026-109619) Exploited in Destructive Check Point Gateway Attacks: What changed No severity, exploitability, status or CVSS change: the record is already CRITICAL/ACTIVE.

Sources cited

• Check Point SK1000362 - CVE-2026-123039 Gaia DynamicCLI privilege escalation Check Point · Advisory · 2026-11-08
• Check Point Research - PHP2Shell Exploitation on Check Point Gateway Check Point Research · Research · 2026-11-12
• chainreactors/gogo - open-source scanner abused for internal discovery GitHub · Code repository
• Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi cybersecuritynews.com · News · 2026-11-13
• The Register - Dream Security PHP2Shell chain rooted 25 Palo Alto servers The Register · News
• TechRadar - Chinese hackers build PHP2SHELL exploit, use it to root 25 servers techradar.com · News

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Other reports on CVE-2026-109618

• AI-Accelerated Exploitation and Agentic Post-Compromise Activity (PHP2Shell CVE-2026-109618/109619, DIVD Zammad Breach CVE-2026-102489/102490) — Shift from Patching to Mitigation
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released
• October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)
• ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell Scanning
• Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewalls

Other reports on CVE-2026-109619

• Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)
• Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise
• Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)
• PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized Following Japanese Real Estate Extortion Campaign by kkkkevin777
• PHP HTTP2Shell: Critical Brotli Out-of-Bounds Write Reachable via cURL (CVE-2026-111497, CVE-2026-109618, CVE-2026-109619)
• Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets Admin-Level Attackers Execute System Commands

Previous and next in vulnerability

• CVE-2026-125926: SSRF in mcp-gateway-registry (v1.0.3-v1.34.0) Exposes Internal Network Services and Cloud Metadata (AWS Bulletin 2026-180-AWS) Previous report