PHP2Shell Check Point Campaign Drops TSGA Backdoor on Unpatched Firewalls
PHP2Shell Check Point attacks gave intruders root on unpatched Security Gateways, then a backdoor, then a path to VMware. At some Israeli organizations, the attack ended with wiped ESXi hosts. The fix had shipped a week earlier.
- Who should care: Anyone running Check Point Security Gateways with Mobile Access exposed to the internet.
- What could go wrong: Root on your firewall, a backdoor that edits its own logs, and wiped VMware hosts.
- Do this: Confirm your gateway build today. Then hunt, because a patch won’t remove an implant.
- Worth remembering: A firewall is a server with a public IP. Hunt on it like one.
What Happened?
The first wave of PHP2Shell Check Point intrusions started October 30, 2026, and targeted Israeli organizations through Mobile Access portals. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of PHP runtime bugs rated CVSS 9.2. It gave attackers code execution as the portal service account. A broader second wave on November 2 hit several countries and sectors, with no destruction seen, according to Check Point Research.
How a PHP runtime bug turned into a firewall campaign in under three weeks.
Roughly two dozen customers were hit between October 30 and November 4.
How the PHP2Shell Check Point Attack Chain Works
CVE-2026-123039, a missing-authorization flaw in the Gaia OS DynamicCLI process (CVSS 7.8), took attackers from the portal account to root. They dropped PHP webshells, the TSGA backdoor, and the gogo scanner. Then they used SSH and the vpxuser account to reach an ESXi host and run the destroy_v6 wiper.
The firewall was the way in. Every step after that ran with root on a device most teams never hunt on.
Wave two on November 2 reached multiple countries and sectors, with no data destruction observed.
What’s the Impact?
Check Point counts about two dozen affected customers. TSGA steals gateway configuration, survives in backups and snapshots, injects into processes, and tampers with binary firewall logs. So the device meant to record a PHP2Shell Check Point break-in can hide one. In wave one, that access ended with the destruction of virtualization infrastructure.
Who’s Behind the PHP2Shell Check Point Campaign?
TSGA and its TSProxy component are modified versions of PhiliKit. That toolkit is linked to the China nexus group Armory Castle (formerly UNC5221) and to earlier Ivanti attacks. Check Point won’t make that call with high confidence. A wiper, politically themed DREAM_ANNEXATION.txt notes, and an Israel focus are unusual for that group. An access broker, a false flag or a smoke screen are all still possible.
How to Avoid This
- Update to R82.20 Take 14, R82.10 Take 52, R82 Take 132 or R81.20 Take 174, or install the November Jumbo Hotfix. Our PHP2Shell fix guide covers the PHP side.
- Hunt for zz*.tpl files in the Mobile Access templates folder, plus /tmp/.bd.log, /tmp/.p_sock and /lib/libcpfwcommon.so.
- Rebuild any gateway that shows signs of compromise, and rotate every credential and key it stored.
- Check ESXi logs for SSH logins by vpxuser, and turn SSH off on hosts that don’t need it.
- Block 130.94.19[.]204 and 130.94.19[.]168, and cut Mobile Access exposure where you can.
The full PHP2Shell Check Point indicator set is below. watchTowr and Help Net Security track the wider PHP2Shell picture.
Hashes, paths and infrastructure tied to the October 30 to November 4, 2026 campaign against Check Point Mobile Access portals. Run these against gateway file systems, ESXi hosts and firewall logs.
challenge_render.tpl in the portal directory
/tmp/.up.tpl (upload path)
/tmp/.bd.log
/tmp/.p_sock (Unix socket)
Source: Check Point Research, November 12, 2026. A clean scan does not prove a clean gateway: TSGA can tamper with binary firewall logs.
Patched Is a Claim. Proven Is a Fact.
The fix was public seven days before the first break-in. What failed was follow-through: the patch tracking grunt work most teams never have time for. Here’s how to prove a PHP2Shell patch actually took effect.
- AI teammates attack your internet-facing gateways and VPN portals the way real attackers do, and flag what’s still open.
- Exploited flaws like PHP2Shell move to the top of the queue, ranked by what’s actually reachable from outside.
- Hardening runs under rules your team sets, with approvals where you want a human in the loop.
- Every fix gets retested and proven closed, with evidence ready for audit.
- Your analysts get back the hours they spend chasing build numbers across devices.
Attack. Harden. Prove. Repeat.
