Title: Active Exploitation of Check Point Security Gateways Chains PHP2Shell With Gaia Privilege Escalation to Deploy TSGA Backdoor
Summary:
Check Point Research has documented an ongoing campaign against unpatched Check Point Security Gateways, with the first wave on October 30, 2026 coming about a week after the PHP2Shell fix had become available. Traffic traced to 130.94.19[.]204 reached Israeli organizations over vulnerable Mobile Access portals; Check Point ties that activity to PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and says it found evidence of successful compromises, some involving destructive action. Once inside, the attacker moved from the portal service account to root using CVE-2026-123039, a missing-authorization flaw in the DynamicCLI IPC interface (CVSS 7.8): the root-run DynamicCLI daemon takes command strings from a world-writable control socket without checking who is connecting and runs them as root, so any locally authenticated user can end up executing as root — Check Point notes the bug presupposes code already running locally on the appliance and reports it has seen live exploitation at roughly two dozen customer sites. The attackers then deployed PHP webshells (files named zz*.tpl in the portal’s templates directory, keyed to zz2026), the persistent TSGA backdoor running as slot_CPconfigdaemon, and its embedded TSProxy networking component dropped to /lib/libcpfwcommon.so; TSGA can provide encrypted remote access, steal configuration, persist through backups and snapshots, inject processes, and tamper with firewall logs. They also ran the gogo scanner, pivoted to a VMware ESXi host over SSH using the vpxuser service account, and executed the destroy_v6 Linux ELF wiper, which zeroes and deletes files and drops a politically themed DREAM_ANNEXATION.txt note in each directory. A broader second wave on November 2 hit organizations across multiple countries and sectors with no destructive activity. CVE-2026-123039 affects R82.20, R82.10, R82, R81.20, R81.10 and R81 of Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator. Attribution is unresolved: TSGA and TSProxy are Check Point-specific variants of the PhiliKit toolset that ESET attributed to the China-nexus group tracked as Armory Castle (formerly UNC5221), and infrastructure and working-hour patterns fit a China-aligned actor, but the wiper, the Israel focus and the Hebrew note do not align — Check Point says scenarios from full operation to initial-access-broker to false flag remain plausible, and the destructive stage may have served as a smoke screen. Remediation is uneven across branches: per Check Point’s advisory sk1000362, CVE-2026-123039 is fixed only in Jumbo Hotfix Accumulator takes — R82.20 from Take 14, R82.10 from Take 52, R82 from Take 132 and R81.20 from Take 174 — while R81 and R81.10 are end-of-support with no fixed build, so on those versions the only available step is the mitigation of stopping the dynamic_server process and keeping it from restarting. All gateways should additionally be audited for the webshell, slot_CPconfigdaemon and /lib/libcpfwcommon.so artifacts.
References:
- Check Point Research: PHP2Shell Exploitation on Check Point Gateway
- The Hacker News: Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
- Check Point Support Center sk1000362: CVE-2026-123039 — Local privilege escalation to root in the DynamicCLI process