[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:check-point-gaia-under-attack-php2shell-chained-to-root-for":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","rapid-alert","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","Marcus Lenngren","2026-11-13T11:18:49.874+00:00","![Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nAttackers are breaking into Check Point Security Gateways through their Mobile Access portals, then escalating to root and, in some cases, destroying VMware ESXi hosts.\n\nThe entry point is PHP2Shell, two critical PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619 that affect all PHP versions from PHP 5 onwards. These were patched upstream on 21 Oct. Attackers reach the portal service account, then exploit CVE-2026-123039, a local privilege escalation in the Gaia OS DynamicCLI interface rated 7.8.\n\nThe DynamicCLI daemon (dynamic_server) runs as root and listens on a world-writable local socket, \u002Ftmp\u002Fdynamic_socket, without authenticating the connecting process. Any local user can send a command and have it run as root. This is not a standalone remote flaw: prior access is required, which the PHP2Shell step provides.\n\nAfter gaining root, attackers plant PHP webshells in the portal template directory, install the TSGA backdoor (running as slot_CPconfigdaemon) and its embedded TSProxy component written to \u002Flib\u002Flibcpfwcommon.so. They used the gogo scanner to find internal systems, then pivoted to a VMware ESXi host over SSH using the vpxuser account and ran the destroy_v6 wiper, leaving DREAM_ANNEXATION.txt notes.\n\nTSGA and TSProxy share code and cryptographic material with PhiliKit, previously linked to China nexus UNC5221. Check Point says the evidence does not allow a high-confidence attribution, and lists tool reuse, access brokering and false flag as plausible.\n\n## Timeline\n\n- 21 Oct: PHP2Shell patched upstream.\n- 30 Oct: Wave one, against Israeli organisations, with destructive activity against some.\n- 2 Nov: Wave two, worldwide and across sectors, no evidence of data destruction.\n- 12 Nov: Check Point Research publishes its analysis.\n- 13 Nov: Check Point releases emergency hotfixes.\n\n## Am I affected?\n\nCheck Point lists affected releases from R81 through R82.20, including Firewall, Security Gateway, Multi-Domain Security Management Server, Security Management Server, Scalable Platforms, logging and Maestro products. Spark Firewalls and Smart-1 Cloud are not affected.\n\nYou are most exposed if you run a Mobile Access portal reachable from the internet. Check Point confirmed active exploitation against about two dozen customers. Neither wave showed a clear sector focus, so treat this as opportunistic.\n\n## What to do now\n\n1. Apply the fixed Jumbo Hotfix for your train: R82.20 Take 14, R82.10 Take 52, R82 Take 132, or R81.20 Take 174.\n2. If you cannot patch immediately, stop the dynamic_server process and prevent it from restarting. Note this disables Dynamic CLI commands.\n3. Confirm the socket is fixed: \u002Ftmp\u002Fdynamic_socket should show permissions 0660, owned by root config, not 0777.\n4. Pull and check against Check Point's published IOCs.\n5. If you find signs of compromise, treat any connected ESXi hosts as at risk and check vpxuser SSH access and backups immediately.\n\n## How to hunt\n\n- Examine \u002Fvar\u002Flog\u002FdynamicCli.log for commands that do not use the default Clish wrapper and for the system() sink, which is uncommon or absent in legitimate traffic.\n- Look in the portal template directory for .tpl files matching zz*.tpl, and for a challenge_render.tpl you did not create.\n- Check \u002Fopt\u002FCPcvpn-R81.20\u002Ftmp\u002F for PHP session files containing the upload_progress_pwn marker.\n- Look for hundreds of Apache\u002FPHP worker segmentation faults during late October.\n- Check for \u002Ftmp\u002FCPconfigdaemon, slot_CPconfigdaemon in the boot persistence directory, \u002Flib\u002Flibcpfwcommon.so, \u002Ftmp\u002F.bd.log and \u002Ftmp\u002F.up.tpl.\n- On ESXi, look for \u002Ftmp\u002Fdes wiper and DREAM_ANNEXATION.txt notes.\n\n## What does not help\n\nRejected connection logs show blocked attempts, not proof that an earlier compromise was prevented. Do not treat them as an all-clear. Hunt for the webshells, TSGA and the socket permissions directly.\n\n## Sources\n\n- [Hackers Exploit Check Point Firewall Flaws to Gain Root Access and Deploy Wiper Malware on VMware ESXi](https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-exploit-check-point-firewall-flaws\u002F), Cyber Security News, 13 Nov\n- [Check Point warns of zero-day flaw exploited for root access](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcheck-point-patches-zero-day-that-lets-hackers-get-root-access\u002F), BleepingComputer, 13 Nov\n- [PHP2Shell Exploitation on Check Point Gateway](https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002Fphp2shell-exploitation-on-check-point-gateway\u002F), Check Point Research, 12 Nov\n- [PHP2Shell Exploited in Destructive Check Point Gateway Attacks](https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-exploited-in-destructive-check-point-gateway-attacks\u002F), SecurityWeek, 13 Nov\n- [Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-exploit-php2shell-flaws-in.html), The Hacker News, 13 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"sparrow-framework-china-linked-clusters-use-fake-chrome-cert","Sparrow framework: China-linked clusters use fake Chrome cert warnings and Linux footholds","Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsparrow-framework-china-linked-clusters-use-fake-chrome-cert-54104957-cover.png","Sparrow \u002F SquadC rapid alert: Got a 'Certificate Fix' prompt? That installer is a backdoor.","2026-11-11T14:07:03.811+00:00"]