PHP2Shell Flaws Used to Breach Check Point Gateways and Deploy a Wiper
Organizations running affected Check Point appliances face a destructive attack in two waves, with the second reaching several countries.
Attackers have been abusing the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and affecting PHP from version 5 onward, to break into Check Point Gateway appliances and deploy a destructive wiper. Patches arrived on October 21, but exploitation began days earlier and turned mass shortly after. Check Point reports two waves: a destructive round starting October 30 aimed at Israeli organizations, and a second starting November 2 hitting organizations in several countries without destructive activity. After gaining initial access, the intruders used a local privilege escalation, CVE-2026-123039, to reach root, then planted PHP webshells and TSGA and TSProxy backdoors before wiping a VMware ESXi host and leaving a note naming Dream Security. Check Point says the attribution to China-linked activity is unclear, since the wiper and destructive aims do not match known Chinese operations.
Why it matters
The campaign shows that a flaw in PHP can open the door to network security appliances, not just websites, and that patches released after exploitation has begun may arrive too late for some victims. Organizations that depend on gateway appliances for perimeter protection now have to consider whether those devices could be the first point of compromise. Attribution remains uncertain, since the wiper and destructive aims do not match known Chinese operations, so readers should treat the China link as unresolved rather than settled.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.