What Happened
Attackers are turning Check Point PHP2Shell exposure into destructive intrusions. An unknown threat actor exploited PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 in unpatched Check Point Mobile Access portals, BleepingComputer reports. The attackers then used CVE-2026-123039, a missing authorization flaw in the Gaia OS DynamicCLI process rated CVSS 7.8, to gain root. Check Point confirmed exploitation against a couple of dozen customers.
The first wave hit Israeli organizations on October 30, about one week after fixes shipped. A broader wave followed on November 2 across multiple countries and sectors. Attackers dropped PHP web shells and the TSGA backdoor, scanned internal networks, and moved over SSH to VMware ESXi hosts using the vpxuser account. Some victims saw a wiper named destroy_v6 erase files. The toolkit overlaps with PhiliKit, which ESET links to a China-nexus group. Check Point has not confirmed attribution.
Why This Matters for Canadian Organizations
Check Point firewalls and remote access gateways sit at the edge of many Canadian banks, provincial agencies, municipalities, hospitals, and mid-size firms. A compromised gateway hands the attacker root on the device built to keep them out. From there, the path to ESXi hosts puts every virtual server at risk. The second wave was opportunistic, so geography offers no protection.
Patch lag remains the core problem. Attackers moved one week after fixes landed, while many Canadian teams schedule firewall upgrades monthly or quarterly. A wiper event touching personal information triggers breach assessment duties under PIPEDA and Quebec’s Law 25. Federally regulated operators in finance, telecom, and energy face added scrutiny under Bill C-8 critical cyber systems rules.
What to Do
Apply Check Point’s fixes for PHP2Shell and CVE-2026-123039 (advisory SK1000362) on every gateway running R81 through R82.20. Disable the Mobile Access portal on any gateway without a business need for it. Hunt for PHP web shells, a process named slot_CPconfigdaemon, TSProxy components, and destroy_v6 binaries. Review ESXi logs for SSH logins from gateway addresses and lock down the vpxuser account. Keep offline, immutable backups of virtual machines. Report confirmed compromise to the Canadian Centre for Cyber Security. Follow our TechTalk coverage and latest news for updates.
