Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell
Unpatched Check Point gateways were wiped after exploitation of PHP2Shell and privilege escalation flaws.
Attackers exploited unpatched Check Point Security Gateways via the Mobile Access portal, using PHP2Shell for initial access and a privilege escalation vulnerability (CVE-2026-123039) to gain root access. The attackers deployed webshells, a backdoor named TSGA, and a proxy tool called TSProxy. In some cases, a Linux wiper named destroy_v6 was used, leaving a note named DREAM_ANNEXATION.txt.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Check Point?
Get an email when a new story names Check Point, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited a known vulnerability in Check Point Security Gateways that had not been patched, using the Mobile Access portal as an entry point to deploy PHP2Shell for initial access. By chaining this with a privilege escalation flaw (CVE-2026-123039), attackers achieved root-level control, enabling them to install webshells, backdoors, and a destructive Linux wiper. This incident underscores the severe consequences of leaving internet-facing security appliances unpatched — ironically, the very devices meant to protect the network became the attack surface. Organizations that delay patching network perimeter devices face not just data theft but potentially irreversible destruction of systems and data.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 130.94.19.204
- cve — CVE-2026-123039
- cve — CVE-2026-109618
- cve — CVE-2026-109619
- malware — PHP2Shell
- malware — TSGA
- malware — TSProxy
- malware — destroy_v6