The Check Point ESXi Wiper Attack: How PHP2Shell Led to a Wiped Hypervisor

The Check Point ESXi wiper attack chained together a known web vulnerability called PHP2Shell, a previously unreported root-escalation bug, a custom backdoor, and a pivot straight into VMware's virtualization layer, ending with destructive file deletion on ESXi hosts inside at least some victim networks. According to Check Point's own research, the intrusion they analyzed moved from a web portal exploit to a wiped hypervisor in a single continuous chain, not a series of unrelated incidents.

Jump to the one-week patch gap that made this possible for the detail that matters most to defenders.

The Full Attack Chain, Step by Step

dev.to's detailed technical summary lays out the sequence cleanly: initial access came through PHP2Shell, the previously disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting Check Point's Mobile Access portal. From there, the attackers escalated privileges from the portal's service account all the way to root by exploiting CVE-2026-123039, a missing-authorization flaw in Gaia OS's DynamicCLI interface that Check Point's advisory describes as letting any authenticated local user run arbitrary commands by writing a single request to the socket.

With root access established, the attackers deployed PHP web shells for persistent command execution, then installed a custom backdoor called TSGA, disguised as a process named slot_CPconfigdaemon, along with an embedded networking component called TSProxy that hooks into the gateway's own processes to intercept specially marked connections while letting ordinary traffic pass through untouched. They ran a network-mapping tool called gogo to find other systems on the internal network.

From there, they moved laterally over SSH to a VMware ESXi host using the vpxuser service account, the credential vCenter itself uses to manage ESXi. On the ESXi host, they staged and ran a Linux wiper called destroy_v6, which Check Point's technical analysis describes as recursively deleting files, attempting to overwrite them with zeros first, and dropping a politically themed text file named DREAM_ANNEXATION.txt in every directory it processed.

The One-Week Patch Gap That Made This Possible

The timing here is the part worth sitting with. dev.to's reporting states plainly that "exploitation of PHP2Shell started about seven days after the fix shipped," meaning any gateway with the Mobile Access portal exposed that remained unpatched past October 30, 2026 should be treated as potentially compromised, not merely vulnerable.

Check Point confirmed active exploitation of the root-escalation flaw, CVE-2026-123039, against "a couple of dozen customers" according to The Hacker News, with destructive wiper activity confirmed during the initial, narrower wave of attacks against Israeli organizations starting around October 30, and a second, broader scanning wave against targets worldwide on November 2 that showed no confirmed destructive activity.

Patching closes the entry point, but it doesn't undo what already happened on a compromised box. dev.to's reporting is explicit that "patching closes the hole but does not remove TSGA, web shells or stolen configuration data," meaning any gateway exposed during that one-week window needs an actual compromise assessment, not just an update.

Why Attribution Is Genuinely Unresolved

Check Point ties TSGA and TSProxy to PhiliKit, a malware framework ESET previously documented and attributed to a China-nexus espionage group. But Check Point's own research is unusually direct about the limits of that attribution: "the evidence does not allow us to assess with high confidence the true nature of this operation," naming three distinct possibilities that remain open.

The identified actor may have run the whole campaign, acted only as an initial-access broker for someone else, or the politically themed wiper notes may represent a deliberate false-flag operation. That caution matters for anyone trying to map this incident onto a known threat actor's broader intentions; the tooling lineage is traceable, but who was actually directing it, and why, is not currently established.

What This Means If You Run Check Point Gateways in Front of a Hypervisor

Our verdict: the single most actionable fact in this entire chain is the one-week window between patch availability and active exploitation. Any organization that treats security-appliance patches as lower priority than application patches had, in this specific case, about seven days of grace before exploitation began, and no more.

• Patch CVE-2026-123039 and both PHP2Shell CVEs immediately if you haven't already, and treat the November 16, 2026 CISA federal deadline as a floor, not a target, given that active exploitation started weeks before that deadline was set.
• If your Mobile Access portal was exposed and unpatched any time after October 23, 2026 (when Check Point's hotfix became available), per the original window multiple researchers flagged, run a full compromise assessment rather than assuming a clean patch resolves the incident. TSGA is specifically designed to persist through backups and snapshots.
• Audit whether your firewall or gateway appliances have SSH credentials, like vpxuser, that can reach your hypervisor layer directly, and whether that path is actually necessary for day-to-day operation. This attack's most damaging step wasn't the initial web exploit; it was the unobstructed pivot from a compromised edge device straight into the infrastructure that runs every VM behind it.

FAQ

What is the Check Point PHP2Shell ESXi wiper attack?

It's an attack chain where threat actors exploited PHP2Shell vulnerabilities in Check Point's Mobile Access portal to gain initial access, escalated to root using a separate flaw (CVE-2026-123039) in the DynamicCLI interface, installed a persistent backdoor called TSGA, then pivoted laterally over SSH to a VMware ESXi host using the vpxuser service account and ran a destructive wiper called destroy_v6.

Is CVE-2026-123039 being actively exploited?

Yes. Check Point confirmed active exploitation against approximately two dozen customers, and the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on November 13, 2026, with a federal patch deadline of November 16, 2026. Exploitation reportedly began about one week after Check Point's hotfix first became available.

Has this attack been attributed to a specific threat actor?

Not with high confidence. Check Point found that the backdoor tools, TSGA and TSProxy, share code and infrastructure with PhiliKit, a framework previously attributed to a China-nexus espionage group. However, Check Point's own research states the evidence doesn't rule out the identified actor acting only as an initial-access broker, or the possibility of a false-flag operation given the politically themed wiper notes.

What We Checked Before Publishing

We treated Check Point's own published research as the primary source and cross-referenced the attack-chain sequence, CVE details, and attribution caveats against dev.to's independent technical summary and The Hacker News' reporting on the CISA KEV listing and exploitation scope. We did not find a public victim count for the destructive wiper stage specifically, distinct from the approximately two dozen customers affected by the root-escalation exploit, and we've left that figure unspecified rather than conflating the two.

I'm Rohit, founder of Krova Cloud: this incident is a reminder that the most dangerous step in an attack chain often isn't the initial exploit, it's whatever credential or network path lets an attacker walk from one compromised system into a completely different one. Every Cube on Krova runs its own isolated kernel specifically so that compromising the management layer in front of it doesn't hand an attacker a direct SSH path into the hypervisor underneath every customer's workload. More debugging stories at debugly.dev.

Structured Data

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "headline": "The Check Point ESXi Wiper Attack: How PHP2Shell Led to a Wiped Hypervisor",
      "datePublished": "2026-11-15",
      "dateModified": "2026-11-15",
      "author": {
        "@type": "Person",
        "name": "Rohit"
      },
      "about": ["Check Point PHP2Shell vulnerability", "CVE-2026-123039", "TSGA backdoor", "VMware ESXi wiper attack"]
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "What is the Check Point PHP2Shell ESXi wiper attack?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "It's an attack chain where threat actors exploited PHP2Shell vulnerabilities in Check Point's Mobile Access portal to gain initial access, escalated to root using a separate flaw (CVE-2026-123039) in the DynamicCLI interface, installed a persistent backdoor called TSGA, then pivoted laterally over SSH to a VMware ESXi host using the vpxuser service account and ran a destructive wiper called destroy_v6."
          }
        },
        {
          "@type": "Question",
          "name": "Is CVE-2026-123039 being actively exploited?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Yes. Check Point confirmed active exploitation against approximately two dozen customers, and the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on November 13, 2026, with a federal patch deadline of November 16, 2026. Exploitation reportedly began about one week after Check Point's hotfix first became available."
          }
        },
        {
          "@type": "Question",
          "name": "Has this attack been attributed to a specific threat actor?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Not with high confidence. Check Point found that the backdoor tools, TSGA and TSProxy, share code and infrastructure with PhiliKit, a framework previously attributed to a China-nexus espionage group. However, Check Point's own research states the evidence doesn't rule out the identified actor acting only as an initial-access broker, or the possibility of a false-flag operation given the politically themed wiper notes."
          }
        }
      ]
    }
  ]
}