The Firewall Let Them In. Then Came the Wiper.

Your firewall is supposed to be the thing attackers bounce off. For the past two weeks, it has been the way in. Check Point says an unknown attacker has been breaking into unpatched Check Point Security Gateways through the PHP2Shell flaws, climbing to root with a second vulnerability, planting a backdoor built specifically for Check Point appliances — and in some victims, jumping to their VMware hosts and wiping files.

The campaign started October 30, 2026 against Israeli organizations and widened November 2 into a broader wave across multiple countries and sectors. Check Point has seen the privilege-escalation flaw actively exploited against a couple of dozen customers. The PHP2Shell flaws have been in CISA’s Known Exploited Vulnerabilities catalog since October 26, and fixes have been available since around October 23 — which makes every successful break-in a story about a patch that was available and not applied.

How the attack works

The way in is the gateway’s Mobile Access portal. PHP2Shell — CVE-2026-109618 and CVE-2026-109619 — gives the attacker code execution on the appliance. From there, a second flaw does the climbing: CVE-2026-123039, a missing-authorization bug in the DynamicCLI interface, lets any authenticated local user run arbitrary commands as root by writing a single request to a socket. It affects R82.20, R82.10, R82, R81.20, R81.10, and R81 across the Force Firewall, management, Multi-Domain, and Maestro lines.

With root on the gateway, the attacker drops PHP web shells and installs the real payload: a backdoor called TSGA, with a networking component called TSProxy. Then comes the part that separates this campaign from an ordinary break-in. The attacker scans the inside of the network from the gateway, moves laterally to a VMware ESXi host over SSH using the vpxuser service account, and runs a Linux wiper called destroy_v6. It deletes every file it touches, overwriting with zeros first, and leaves a DREAM_ANNEXATION.txt note in each directory.

The backdoor that hides in the firewall

TSGA is not a generic implant. It runs as slot_CPconfigdaemon — a name chosen to blend in — and it was built for Check Point appliances: encrypted remote access, configuration theft, persistence through backups and snapshots, process injection, and tampering with the firewall’s own logs.

TSProxy is the stealth layer. It loads a library into selected appliance processes, intercepts networking functions, and handles specially marked attacker connections while ordinary traffic continues. The gateway keeps doing its job — filtering, logging, passing traffic — while the backdoor rides inside its own processes. That is what makes this hard to spot from the outside: the box looks healthy.

Who’s behind it — nobody can say for sure

Check Point assesses the pair as Check Point-specific parts of a toolkit called PhiliKit, documented by ESET in June 2026 and attributed to a China-nexus group tracked as Armory Castle (formerly UNC5221). Two details point that way: LightNode VPS infrastructure, and scanning hours of 12:00–9:00 a.m. UTC, matching Chinese working hours.

But Check Point says the evidence does not support a high-confidence attribution. The wiper is the problem: a China-nexus espionage group is not the usual suspect for destructive attacks, and this campaign hit Israeli organizations first and left notes referencing the Israeli-Palestine conflict. Several scenarios remain plausible — the same actor ran the whole thing, it acted only as an initial-access broker, it was a false-flag operation, or the destruction was a smoke screen. The attribution is unresolved, and the wiper is real either way.

Firewalls keep showing up as the way in — in the SonicWall SSL-VPN flaw we covered last week, attackers walked past MFA through the firewall itself, and in the N-able disclosure, one platform’s fall hit its whole customer base. A security appliance is a high-value target precisely because it sits in the middle of everything and is trusted by everything behind it.

What to check right now

If you run Check Point gateways, the order matters — patching first is necessary, but not sufficient on its own.

First, apply the hotfixes. The PHP2Shell patches have been out since around October 23, and the DynamicCLI fix closes the privilege-escalation path. Check every gateway — management and log servers and Maestro appliances too, not just the edge firewalls.

Second, hunt for the backdoor on gateways that were exposed. Look for unexpected PHP web shells, a slot_CPconfigdaemon process that should not be there, and gaps or tampering in firewall logs. A gateway that was reachable from the internet and unpatched during late October or early November should be treated as suspect until proven clean.

Third, check your VMware hosts. Look for SSH logins by the vpxuser service account coming from gateway addresses, any file named DREAM_ANNEXATION.txt, and signs of the destroy_v6 wiper. Verify backups and snapshots are intact — a restore from a tainted snapshot brings the backdoor back. And assume configuration theft: if a gateway was compromised, its VPN settings, credentials, and network layout should be treated as known to the attacker. Rotate credentials and rebuild affected appliances rather than cleaning them in place.

The shape is familiar: a known flaw with a public fix, a second flaw for the climb, a backdoor tailored to the victim’s equipment, and a destructive finish that may or may not be the point. The patch was available before the first wave.