Check Point has confirmed that attackers rooted internet-facing Security Gateways through their Mobile Access portals, using the PHP2Shell flaws for entry and a local privilege escalation in Gaia OS to reach root. One wave ended with a wiper that deleted files on a VMware ESXi host.

What happened

Activity from 130.94.19[.]204 began on 30 October 2026, about a week after a PHP2Shell fix was available, against Israeli organisations. A broader second wave on 2 November hit organisations in multiple countries and sectors with no clear preference. Check Point says the entry point was vulnerable Mobile Access portals running unpatched PHP, consistent with CVE-2026-109618 and CVE-2026-109619.

From the portal service account the attackers escalated to root with CVE-2026-123039, a missing authorisation flaw in the Gaia OS DynamicCLI daemon. That daemon runs as root and listens on a world-writable local socket, /tmp/dynamic_socket, without authenticating connecting processes, so any local user who can write to the socket gets commands executed as root. The CVE record scores it 7.8.

They then dropped PHP webshells into the portal templates directory, installed TSGA as slot_CPconfigdaemon with its TSProxy library, scanned the internal network with gogo, moved to an ESXi host over SSH using the vpxuser account and ran the destroy_v6 wiper. Check Point assesses TSGA and TSProxy as modified PhiliKit components but does not attribute the campaign with confidence.

Who is affected

• Quantum Security Gateway and Quantum Security Management on R81.20 with Jumbo Hotfix Take 173 or below, R82 with Take 130 or below, R82.10 with Take 50 or below, or R82.20 with Take 10 or below.
• Any gateway that publishes a Mobile Access portal to the internet, which is the standard remote-work setup.
• Management and log servers in the same estate, since the escalation gives root to anyone with local code execution.

What to do now

Inventory every Check Point gateway and management server, move each one to a hotfix take above the affected list, and then hunt the portal for webshells before calling the job done.

• Check the installed Jumbo Hotfix Take against Check Point advisory sk1000362 and get above the affected take.
• Search the portal templates directory for unexpected zz*.tpl or challenge_render.tpl files.
• Look for slot_CPconfigdaemon, /tmp/.up.tpl and /lib/libcpfwcommon.so on the appliance.
• Rotate gateway credentials and review ESXi logins by vpxuser; if a gateway was internet-facing and unpatched in late October, treat it as compromised rather than merely outdated.

What this means for South African businesses

Few SA SMEs run Check Point, but the pattern is familiar: a VPN portal a patch cycle behind, plus a local escalation that turns a web service account into root. The destructive stage is the part worth pausing on, because virtual machine files on an ESXi host reachable from the appliance were deleted outright, and that is how a small estate loses its servers in one night. My judgement is that the real risk here is architectural, since a perimeter box that can reach the hypervisor over SSH hands an internet-facing service a path to every virtual machine.

Source: Check Point Research.

Also on the blog

• Windows SignDrop zero-day: SYSTEM from a standard user, no patch yet
• Microsoft 365 Copilot token theft: Luna Moth vishing beats MFA

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.