The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. The attacks started on October 30, initially against Israeli organizations, and were conducted by an actor that ran the entire campaign, from initial access to lateral movement and launching PHP webshells.
In some instances, researchers found political messages during the destructive stage, raising questions about a possible false-flag operation. PHP2Shell is the name for two critical PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on vulnerable systems.
PHP fixed the vulnerabilities in emergency patches on October 21. However, according to Amazon Threat Intelligence, exploitation attempts started four days earlier.
