International
The Morning Dev

Only the news worth knowing

‹
 
A67/100

Vulnerability · high · CVSS 7.8

Check Point gateways exploited via PHP2Shell flaws, added to CISA KEV

Tier A · Patch today – Before you go home

Who’s exposed: Unpatched Check Point Security Gateways worldwide, and ESXi hosts behind them

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild · Full takeover

What to do

  1. Apply Check Point's emergency hotfixes to all Security Gateways
  2. Check gateways for signs of compromise, including the TSGA backdoor and unexpected root persistence
  3. Verify ESXi hosts and backups for wiper damage

The Brief

  • Unpatched Check Point Security Gateways were exploited via PHP2Shell flaws for initial access, with a previously reported local privilege escalation in Gaia OS used to gain root.
  • The attacks deployed the TSGA backdoor and a wiper that erased files on VMware ESXi hosts.
  • Check Point released emergency hotfixes; the exploitation reportedly began on 30 October.

Why it matters

Check Point gateways sit at network edges, so unpatched devices can give attackers root access, persistence and a path into internal networks. Destructive wiper activity against ESXi hosts can cause data loss and outages.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsCheck Point Security Gateways are network security appliances that IT and ops teams run and maintain.
NoCore infrastructureA single vendor's firewall appliance, not software nearly every team runs such as OpenSSH or the Linux kernel.
YesPopular toolCheck Point gateways are widely deployed enterprise security appliances.
YesExploited in the wildCISA SSVCCISA rates exploitation of CVE-2026-123039 as active
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept has been published.
NoRemote, no loginCVSSCVSS: CVE-2026-123039 AV:L/PR:L/UI:N
YesFull takeoverCVSSCVE-2026-123039: CVSS rates confidentiality and integrity impact high
NoSecrets exposedSources report backdoors and wiper attacks but no theft or exposure of credentials, configs or data.
NoSupply chainAttacks exploit gateway vulnerabilities; no source reports compromised packages, updates or build pipelines.
NoNo fix yetBleepingComputer reports Check Point has released emergency hotfixes for the zero-day.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

Timeline

  1. Attacker begins scanning and exploiting unpatched Check Point Security Gateways

  2. Check Point warns of exploitation and releases emergency hotfixes

  3. SecurityWeek

    PHP2Shell Exploited in Destructive Check Point Gateway Attacks

  4. The Hacker News

    Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

  5. BleepingComputer

    Check Point warns of zero-day flaw exploited for root access

  6. Security Affairs

    Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

  7. BleepingComputer

    Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

  8. Security Affairs

    U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog

Full coverage · 6 sources

First seen · 6 sources · Full story page · How tiers are decided