---
title: Hunting the Check Point gateway intrusions: upload_progress_pwn session files, fake CPconfigdaemon, 'Dream Annexation' note | ctxsec
url: https://ctxsec.com/items/hunt-checkpoint-php2shell-gaia-upload-progress-pwn-cpconfigdaemon-dream-annexation
description: "Check Point's indicators for the PHP2Shell + CVE-2026-123039 chain: scanning from 130.94.19[.]204 and 130.94.19[.]168; PHP session files containing upload_progress_pwn; a process or binary posing as a Check Point component named like CPconfigdaemon; scanner or wiper tooling under /tmp or /temp; a ransom-style note mentioning 'Dream Annexation' with no payment demand; and unexplained gaps in firewall traffic logs, especially after a logging daemon crash."
status: "official IOCs (Check Point security advisory, Nov 12, 2026)"
published: 2026-11-12
---

> Check Point's indicators for the PHP2Shell + CVE-2026-123039 chain: scanning from 130.94.19[.]204 and 130.94.19[.]168; PHP session files containing upload_progress_pwn; a process or binary posing as a Check Point component named like CPconfigdaemon; scanner or wiper tooling under /tmp or /temp; a ransom-style note mentioning 'Dream Annexation' with no payment demand; and unexplained gaps in firewall traffic logs, especially after a logging daemon crash.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-checkpoint-php2shell-gaia-upload-progress-pwn-cpconfigdaemon-dream-annexation.md)

official IOCs (Check Point security advisory, Nov 12, 2026)

2026-11-12 7:40 PM ET

### Hunting the Check Point gateway intrusions: upload_progress_pwn session files, fake CPconfigdaemon, 'Dream Annexation' note

- **Check:** PHP session storage on Mobile Access gateways for upload_progress_pwn; process lists and binaries for CPconfigdaemon lookalikes; /tmp and /temp for scanner/wiper files.
- **Logs:** look for connections from the two 130.94.19.x addresses since Oct 30 and for logging gaps after daemon crashes.
- **Caveat:** Check Point says no match doesn't rule out compromise; any match needs immediate investigation.

Sources: [Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026)](https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/)