Check Point Gateway: From Exploiting PHP2Shell to Compromising a VMware ESXi Hypervisor

Check Point Research researchers described real-world attacks against Check Point Security Gateway firewalls that began on October 30, 2026. The attackers exploited PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to gain initial access through the Mobile Access portal, then exploited CVE-2026-123039 to escalate privileges. In one of the investigated attacks, the network device compromise led to an intrusion into the internal infrastructure and data destruction.

Initial access was obtained by processing specially crafted HTTP requests through PHP's session.upload_progress mechanism. After executing code in the portal service's context, the attackers exploited a vulnerability in the DynamicCLI interface to escalate privileges to root. They then placed PHP web shells in the Mobile Access template directory and installed the TSGA backdoor with an embedded TSProxy component that provided covert remote access and traffic proxying.

As a result, the attackers were able to execute commands with root privileges, maintain persistent access to the network device, collect configuration data, and move laterally within the internal network. In the investigated incident, the attackers reached the VMware ESXi hypervisor and launched the malicious program destroy_v6, designed to destroy files.

Article: https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/