The chain has four stages. Each one is a control that was supposed to be separate from the one before it.
Stage 1 — Initial access
PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) on unpatched Check Point Mobile Access portals. Patches shipped October 21, 2026. Campaign started October 30. The gap was nine days and an unpatched portal.
Stage 2 — Privilege escalation
CVE-2026-123039: the Gaia OS DynamicCLI daemon runs as root, listens on /tmp/dynamic_socket, and the socket is world-writable. No authentication on connecting processes. The portal service account sends one command and becomes root. CVSS 7.8 — local vector, low privileges, no user interaction, high impact on C/I/A.
Stage 3 — Persistence
TSGA backdoor installed as slot_CPconfigdaemon. TSProxy written to /lib/libcpfwcommon.so and injected into appliance processes. It intercepts networking functions and handles specially marked attacker connections while ordinary traffic continues. No new listening port. Port scans won’t find it.
Stage 4 — Destruction
Gogo scanner for internal recon. SSH to ESXi host via vpxuser. destroy_v6 ELF wiper staged in /tmp, traverses directories recursively, overwrites files with zeros, deletes them. Leaves DREAM_ANNEXATION.txt in each processed directory rejecting ransom negotiations.
What to hunt
/tmp/dynamic_socket permissions — should be 0660 root:config post-patch
/var/log/dynamicCli.log — commands not using Clish wrapper
slot_CPconfigdaemon — not a real Check Point process
/lib/libcpfwcommon.so — compare against known-good build
upload_progress_pwn in PHP session files
destroy_v6 or DREAM_ANNEXATION.txt on ESXi datastores
SSH logs: vpxuser logins from gateway IPs
Fixed builds
Branch Fixed Take
R82.20 Take 14
R82.10 Take 52
R82 Take 132
R81.20 Take 174
Can’t patch: stop dynamic_server and prevent restart.
Attribution is unresolved. Tools share code with PhiliKit (China-nexus Armory Castle / UNC5221) but Check Point explicitly declines to attribute — the wiper and political messaging don’t fit the profile. Patch regardless; the control is the same either way.
https://threataft.com/articles/check-point-php2shell-cve-2026-123039-tsga-wiper
Top comments (0)