CVE-2026-109619

An unknown threat actor exploited the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) in unpatched Check Point Security Gateways to gain initial access, then used a local privilege escalation flaw (CVE-2026-123039) in Gaia OS to deploy the TSGA backdoor and establish persistent access. The attackers deployed PHP web shells, moved laterally to VMware ESXi hosts via SSH, and executed the destroy_v6 wiper malware to delete files and leave politically themed notes. The campaign targeted Israeli organizations initially, then expanded globally, with some evidence suggesting possible ties to the China-nexus group Armory Castle, though attribution remains uncertain due to the use of wiper malware and political messaging.

Vulnerable Check Point Security Gateway instances were exploited in attacks leveraging the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) to gain unauthenticated remote code execution. Attackers deployed PHP webshells and the TSGA backdoor with TSProxy to establish persistent access, then moved laterally to VMware ESXi hosts using the gogo scanner. A data-wiping malware named destroy_v6 was deployed on ESXi hosts, which performed recursive deletion and zero-filling of data to hinder recovery. A political message in DREAM_ANNEXATION.txt rejected ransom negotiations, indicating destructive intent. The second wave of attacks did not include destructive actions, and attribution remains uncertain despite tentative links to the PhiliKit framework and UNC5221.