# Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi

> Check Point confirmed exploitation against about two dozen customers: PHP2Shell-linked flaws (CVE-2026-109618/109619) in Mobile Access portals give initial access, and a Gaia DynamicCLI local privilege escalation (CVE-2026-123039, CVSS 7.8) gives root. Attackers deployed the TSGA backdoor and TSProxy, the gogo scanner and the destroy_v6 wiper, and pivoted to VMware ESXi. No actor is named.

- **Published:** 2026-11-13T07:11:15Z
- **Last reviewed:** 2026-11-13T08:30:54.503Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5938
- **ID:** TL-2026-5938
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)
- **CVEs:** CVE-2026-109618, CVE-2026-109619, CVE-2026-123039

## Description

Check Point Research (published 2026-11-12) and Check Point advisory SK1000362 describe a campaign against Check Point gateways running R81 through R82.20 (Force Firewalls, Management and Log Servers, Multi-Domain Security Management / Multi-Domain Log Server, and Maestro Orchestrator). Spark Firewalls and Smart-1 Cloud are not affected. Activity began roughly a week after fixes became available. Wave 1 on 2026-10-30 was aimed mainly at Israeli organizations and included destructive activity; portal workers logged hundreds of segfaults. Wave 2 on 2026-11-02 hit organizations in several countries and sectors, with no destructive activity reported.

Initial access is through the Mobile Access portal using PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619 (the same CVE pair is reported by Dream Security in its PHP2Shell research against Palo Alto devices). The primary attacker IP in the Check Point report is 130.94.19.204. The attacker then escalates from the portal service account to root with CVE-2026-123039 (CVSS 7.8). The Gaia dynamic_server process runs as root and accepts commands over /tmp/dynamic_socket, which is world-writable on vulnerable systems and does not verify the submitting user; commands reach a system() sink. The flaw needs prior local code execution and is not a standalone remote flaw.

PHP webshells named <templates>/zz<random>.tpl are dropped in the Mobile Access templates directory, written by a base64-decoded dropper. They are protected by the hardcoded key zz2026 and support OS command execution, PHP evaluation and file upload (staged via /tmp/.up.tpl and copied to challenge_render.tpl); commands can be plain text or Base64/XOR-obfuscated. PHP session files under /opt/CPcvpn-R81.20/tmp/ carry the marker upload_progress_pwn.

The TSGA backdoor is dropped as /tmp/CPconfigdaemon, launched with nohup and output to /tmp/.bd.log, then relocates itself to a boot persistence directory as slot_CPconfigdaemon. It listens on TCP 11072 on all IPv4 interfaces and a Unix socket /tmp/.p_sock, and provides encrypted remote access, PTY shells, Python/Perl execution, file transfer, configuration theft, backup/snapshot persistence, process injection and binary firewall-log tampering. It embeds TSProxy, written to /lib/libcpfwcommon.so and injected into selected appliance processes; it hooks networking functions to handle specially marked attacker connections while passing normal traffic, and provides encrypted SOCKS-style proxying. The open-source gogo scanner (chainreactors/gogo) is used from the gateway for internal discovery, followed by SSH to an ESXi host using the vpxuser service account.

The destroy_v6 Linux ELF wiper takes a target directory, overwrites files with zeros and then deletes them regardless of extension (-f skips the overwrite, -w excludes a pipe-separated directory list). It writes a politically themed Hebrew note, DREAM_ANNEXATION.txt, to each processed directory rejecting ransom negotiation. It was staged on ESXi as /tmp/des wiper.

Attribution is unresolved. TSGA shares Tiny SHell roots, port 11072 and the /tmp/.p_sock socket with PhiliKit, and TSProxy shares operator credentials, transport secrets, activation-selector digests and the TLS certificate/private key with PhiliKit's libdssafe.so. PhiliKit was previously linked by ESET to China-nexus UNC5221 per Check Point, but Check Point found no evidence tying PhiliKit to this incident and notes that the destructive activity, Israel focus and Hebrew note do not fit that profile. Infrastructure is on LightNode VPS (previously associated with China-nexus activity) and scanning concentrated 00:00-09:00 UTC. Tool reuse, an initial access broker, a false flag or destruction as a smoke screen all remain open. The source does not mention CISA KEV listing. Only CVE-2026-123039 has a stated CVSS (7.8); no CVSS is stated for CVE-2026-109618/109619.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.006 Command and Scripting Interpreter: Python
- T1036 Masquerading
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1090 Proxy
- T1573 Encrypted Channel
- T1046 Network Service Discovery
- T1021.004 Remote Services: SSH
- T1078 Valid Accounts
- T1485 Data Destruction
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
- T1070 Indicator Removal
- T1005 Data from Local System
- T1583.003 Acquire Infrastructure
- T1547 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1571 Non-Standard Port
- T1561.001 Disk Wipe

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Check Point Mobile Access PHP2Shell Webshell Drop (zz*.tpl / challenge_render.tpl) — Exploitation** (`TL-2026-5938-SPL-001`)

Detects the PHP2Shell webshell footprint left by exploitation of Check Point Mobile Access portals (CVE-2026-109618 / CVE-2026-109619): zz<random>.tpl files in the portal templates directory, hardcoded key zz2026, upload staging via /tmp/.up.tpl copied to challenge_render.tpl, PHP session marker upload_progress_pwn, and traffic from the primary attacker IPs 130.94.19.204 / 130.94.19.168. Part of the destroy_v6 wiper campaign.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003, T1027
- **Data sources:** linux:audit (auditd on Gaia), syslog (Gaia /var/log/messages), Check Point Mobile Access portal
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=linux (sourcetype=linux:audit OR sourcetype=syslog) earliest=-24h ("zz2026" OR "upload_progress_pwn" OR "challenge_render.tpl" OR "/tmp/.up.tpl" OR "130.94.19.204" OR "130.94.19.168" OR (type=PATH name="*/CPcvpn-*" name="*/zz*.tpl")) ```PHP2Shell webshell artifacts on Check Point Mobile Access: zz random tpl drops, hardcoded key zz2026, session marker upload_progress_pwn, staging via .up.tpl copied to challenge_render.tpl```
| eval indicator=case(like(_raw,"%upload_progress_pwn%"),"php_session_marker", like(_raw,"%zz2026%"),"webshell_hardcoded_key", like(_raw,"%challenge_render.tpl%"),"challenge_render_copy", like(_raw,"%/.up.tpl%"),"upload_staging_file", match(_raw,"130\\.94\\.19\\.(204|168)"),"report_attacker_ip", true(),"zz_random_tpl_dropped")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators values(name) as paths by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - count
````

### Microsoft KQL

```kql
let AttackerIps = dynamic(["130.94.19.204", "130.94.19.168"]);
let HostHits = Syslog
    | where TimeGenerated > ago(24h)
    | where SyslogMessage matches regex @"zz2026|upload_progress_pwn|challenge_render\.tpl|/tmp/\.up\.tpl|/CPcvpn-[^ ]*/zz[A-Za-z0-9]+\.tpl"
    | extend Indicator = case(
        SyslogMessage contains "upload_progress_pwn", "php_session_marker",
        SyslogMessage contains "zz2026", "webshell_hardcoded_key",
        SyslogMessage contains "challenge_render.tpl", "challenge_render_copy",
        SyslogMessage contains "/tmp/.up.tpl", "upload_staging_file",
        "zz_random_tpl_dropped")
    | project TimeGenerated, Source = "Syslog", Computer, Indicator, Detail = SyslogMessage;
let NetHits = CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceVendor =~ "Check Point"
    | where SourceIP in (AttackerIps) or DestinationIP in (AttackerIps)
    | project TimeGenerated, Source = "CommonSecurityLog", Computer = DeviceName, Indicator = "report_attacker_ip",
        Detail = strcat(SourceIP, " -> ", DestinationIP, ":", tostring(DestinationPort));
union HostHits, NetHits
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Check Point Mobile Access PHP2Shell Webshell Artifacts
id: 7c1e5a42-3b6d-4f0e-9a21-5d8c0b7e4a11
status: experimental
description: Detects PHP2Shell webshell files dropped in the Check Point Mobile Access templates directory (zz random tpl files, challenge_render.tpl, .up.tpl staging) after exploitation of CVE-2026-109618 and CVE-2026-109619.
references:
    - https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
    - https://support.checkpoint.com/results/sk/sk1000362
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.defense_evasion
    - attack.t1027
    - cve.2026.109618
    - cve.2026.109619
    - cve.2026.123039
logsource:
    product: linux
    service: auditd
detection:
    selection_zz_tpl:
        type: 'PATH'
        name|contains: '/CPcvpn-'
        name|re: '/zz[A-Za-z0-9]+\.tpl$'
    selection_named:
        type: 'PATH'
        name|endswith:
            - '/challenge_render.tpl'
            - '/.up.tpl'
    condition: 1 of selection_*
falsepositives:
    - Check Point support or TAC staging legitimate portal template customisations
    - Administrators uploading custom portal tpl files during maintenance
level: high

```

**Known false positives:**

- Check Point support staging legitimate portal template customisations
- Administrators uploading custom .tpl files to the portal during maintenance

**Tuning notes:** Scope to Gaia hosts running Mobile Access. Enable an auditd watch (-w on the CPcvpn templates directory -p wa) so PATH records exist. Exclude known admin change windows. The attacker IP terms are point-in-time; keep them fresh from SK1000362 and Check Point Research.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TSGA Backdoor Dropper: CPconfigdaemon / [indicator] on Gaia — Post-Exploitation (locked: unlock with TL Creds)
- TSProxy libcpfwcommon.so Injection on Gaia — Process Injection and Proxying (locked: unlock with TL Creds)
- ESXi SSH Login as [indicator] From Gateway or Unapproved Host — Lateral Movement (locked: unlock with TL Creds)
- gogo Scanner Executed on Check Point Gateway — Internal Discovery (locked: unlock with TL Creds)
- destroy_v6 Wiper Execution and [indicator] Note on ESXi — Impact (locked: unlock with TL Creds)
- Check Point Firewall Binary Log Tampering (fw1/log) — Defense Evasion (locked: unlock with TL Creds)
- Check Point Gaia DynamicCLI Local Privilege Escalation (CVE-2026-123039) — Post-Exploitation (locked: unlock with TL Creds)
- TSGA Backdoor C2: TCP [indicator] and Attacker Infrastructure — C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- IP address: `130.94.19[.]204`
- File hash: `edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3`
- IP address: `130.94.19[.]168`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Check Point SK1000362 - CVE-2026-123039 Gaia DynamicCLI privilege escalation](https://support.checkpoint.com/results/sk/sk1000362)
- [Check Point Research - PHP2Shell Exploitation on Check Point Gateway](https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/)
- [Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi](https://cybersecuritynews.com/hackers-exploit-check-point-firewall-flaws/)
- [The Register - Dream Security PHP2Shell chain rooted 25 Palo Alto servers](https://www.theregister.com/a/5306456)
- [TechRadar - Chinese hackers build PHP2SHELL exploit, use it to root 25 servers](https://techradar.com/pro/security/chinese-hackers-build-php2shell-exploit-use-it-to-root-25-servers-breach-us-government-affiliated-firewalls)
- [chainreactors/gogo - open-source scanner abused for internal discovery](https://github.com/chainreactors/gogo)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5938