Check Point is urging customers to install its November Jumbo Hotfix after attackers chained PHP2Shell with a local privilege-escalation flaw on unpatched gateways. The vendor’s November 12 advisory describes exploitation observed from October 30 through November 4.
Initial access used PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619, against Mobile Access portals. Attackers then exploited CVE-2026-123039 in Gaia’s DynamicCLI service to obtain root privileges. Check Point assigns the latter a CVSS score of 7.8 and lists Gaia R81.20, R82, R82.10 and R82.20 as affected.
In the investigated intrusion, attackers installed webshells and the TSGA backdoor with its TSProxy component, then moved over SSH to a VMware ESXi host and deployed the destroy_v6 wiper. Destructive activity affected some first-wave targets; researchers found no evidence of destruction in the broader November 2 wave.
Tooling overlaps with PhiliKit, previously linked to a China-nexus actor, do not establish who directed this operation. Check Point leaves attribution and motive uncertain.
Administrators should prioritize internet-facing Mobile Access deployments and apply the November hotfix to gateways and management servers. Consult Check Point’s installation guidance for the appropriate package and review the published indicators for possible compromise. Patching alone does not establish that an already compromised system is clean.
