Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Beginning October 30, 2026, threat actors exploited two critical unauthenticated remote-code-execution vulnerabilities in PHP—collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619)—to compromise Check Point Security Gateway instances via their internet-facing Mobile Access portals. Attackers chained PHP2Shell with a Check Point zero-day (CVE-2026-123039) for root privilege escalation, installed PHP webshells and the TSGA/TSProxy backdoor for persistent command-and-control, used the gogo scanner for internal VMware ESXi host discovery, and finally detonated the destroy_v6 data-wiper on ESXi hosts—recursively deleting data with zero-fill overwriting—targeting Israeli organizations in the first wave and multi-sector global targets in a second wave on November 2, 2026.

This incident illustrates an accelerating pattern of state-linked or hacktivist actors combining unpatched edge-device vulnerabilities with destructive wiper payloads to cause irreversible operational damage rather than financial gain. The tentative linkage to the Chinese threat cluster UNC5221 and the deliberate false-flag political messaging underscore growing geopolitical dimensions in infrastructure attacks, raising the urgency for organizations to enforce rapid patch cycles and network segmentation on perimeter security appliances.

Why This Matters Now

Wiper malware targeting virtualization infrastructure reached a historic high in 2025–2026, with attackers exploiting edge security appliances—the very tools meant to protect networks—as initial footholds. PHP2Shell exploitation began four days before patches existed, CISA KEV-listed both CVEs within days, and the attack chain from internet-facing portal to ESXi destruction completed in hours, leaving organizations with no recovery path once destroy_v6 executed its zero-fill overwrite.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

After gaining root access through chained PHP2Shell and CVE-2026-123039 exploits, attackers installed the TSGA backdoor with TSProxy for covert C2, then used the open-source gogo scanner to discover internal VMware ESXi hosts and pivoted to them via unauthorized SSH—a lateral movement path that proper east-west traffic segmentation and Zero Trust microsegmentation policies between the gateway DMZ and the virtualization layer could have interrupted.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers exploited an internet-facing gateway to pivot deep into internal VMware ESXi infrastructure, a lateral path that workload segmentation and east-west enforcement would likely have constrained. By reducing trust relationships between the compromised gateway and internal compute infrastructure, Aviatrix CNSF could have meaningfully limited the attacker's reachability and reduced the blast radius before destructive wiper deployment.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inbound access to the Mobile Access portal from unauthorized or unrecognized source ranges could likely be constrained through cloud-layer access controls, reducing the reachable attack surface available to unauthenticated external actors targeting the exposed PHP endpoints.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation enforced at the workload level could likely constrain the PHP process's ability to reach privileged kernel interfaces or communicate with components outside its expected execution scope, reducing the practical blast radius of the initial RCE even if the vulnerability itself is not prevented.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west segmentation policies could likely block unauthorized SSH connections originating from the gateway appliance toward ESXi management interfaces, limiting the attacker's ability to pivot from a compromised perimeter device into internal virtualization infrastructure even after achieving root on the gateway.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic observability across the hybrid environment could likely surface anomalous outbound or loopback traffic patterns associated with TSProxy's listening behavior, reducing the attacker's ability to maintain covert C2 channels without generating detectable deviations from established traffic baselines.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement could likely restrict unauthorized outbound connections from the gateway to attacker-controlled infrastructure, reducing the reachability of any exfiltration-capable channels established by TSGA or the installed webshells even if the backdoor itself is not detected.

Impact (Mitigations)

Had prior Zero Trust segmentation and east-west controls been in place, the attacker's ability to reach ESXi hosts from the compromised gateway would likely have been significantly constrained, meaning the wiper could only have been delivered to assets that fell within any residual reachable scope — reducing the number of ESXi hosts exposed to destructive activity rather than eliminating risk entirely.

Impact at a Glance

Affected Business Functions

  • Network Security Gateway Operations and VPN Services
  • VMware ESXi Virtualization Infrastructure and Hosted Workloads
  • Security Operations and Incident Response
  • Business Continuity and Disaster Recovery
Operational Disruption

Estimated downtime: 21 days

Financial Impact

Estimated loss: N/A

Data Exposure

The destructive wiper malware destroy_v6 recursively deleted data on VMware ESXi hosts using zero-fill overwriting to prevent recovery, resulting in permanent destruction of virtual machine disk images, hosted application data, configuration files, and potentially sensitive business data residing on ESXi datastores. Organizations in multiple sectors and countries were affected across two attack waves beginning October 30, 2026. The first wave targeted Israeli organizations with full destructive payload deployment; the second wave on November 2 targeted multiple countries with unclear follow-on actions. Backdoor installation via TSGA and PHP webshells indicates likely exfiltration of gateway credentials, network topology data, authentication tokens, and VPN session data prior to the destructive phase. The political note DREAM_ANNEXATION.txt left on breached hosts and explicit rejection of ransom negotiations confirms the sole intent was maximum data destruction and operational disruption with no recovery path.

Recommended Actions

  • • Apply Zero Trust Segmentation (microsegmentation) to enforce identity-based, least-privilege access policies between gateway appliances and internal hypervisor/ESXi management interfaces, eliminating implicit east-west trust that enabled lateral SSH movement from the compromised gateway to ESXi hosts.
  • • Deploy East-West Traffic Security controls to continuously monitor and enforce workload-to-workload communication policies across internal network segments, ensuring that anomalous SSH or scanning traffic originating from perimeter appliances (such as security gateways) to core infrastructure is detected and blocked in real time.
  • • Leverage Inline IPS (Suricata) with up-to-date signatures for known CVE exploit patterns (including PHP2Shell and Linux kernel privilege escalation payloads) on inbound traffic to internet-facing gateway portals, supplemented by Cloud Firewall (ACF) policies that restrict Mobile Access portal exposure to authorized source IP ranges only.
  • • Enforce Egress Security & Policy Enforcement with FQDN/IP-based outbound filtering on all gateway and hypervisor egress paths to prevent covert C2 channels (such as TSProxy-based backdoor communications) from establishing persistent attacker connectivity through the compromised environment.
  • • Activate Multicloud Visibility & Control capabilities to baseline normal gateway and ESXi traffic patterns, enabling rapid detection of anomalous behaviors such as internal port scanning (gogo scanner activity), unexpected process execution on appliances, and unauthorized outbound connections indicative of backdoor or wiper staging activity.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image