Vulnerability · high · CVSS 7.8
Check Point gateways exploited via PHP2Shell flaws in destructive attacks
Tier A · Patch today – Before you go home
Who’s exposed: Unpatched Check Point Security Gateways running Gaia OS and their connected ESXi hosts
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Full takeover
What to do
- Apply available Check Point patches for the PHP2Shell vulnerabilities and the Gaia OS privilege escalation flaw
- Hunt for TSGA backdoor indicators and review gateway logs for signs of compromise
- Verify backups of ESXi hosts are current and offline-protected
The Brief
- An unknown threat actor is exploiting unpatched Check Point Security Gateways via PHP2Shell vulnerabilities for initial access.
- Attackers then use a previously reported local privilege escalation flaw in Gaia OS, CVE-2026-123039, to gain root.
- The activity deploys a backdoor called TSGA and wipes ESXi files.
Why it matters
Organisations running unpatched Check Point Security Gateways face full compromise and destructive data loss, including on ESXi hosts reachable from the gateway.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: Check Point Security Gateways are network security appliances (firewalls) that IT and ops teams run. |
| No | Core infrastructure | Judgment: a single vendor's appliance family, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Check Point gateways are a widely deployed enterprise firewall appliance. |
| Yes | Exploited in the wild | The Hacker News: an unknown threat actor has been observed targeting unpatched Check Point gateways. |
| No | Public exploit | Neither source says exploit code or a step-by-step PoC is published. |
| No | Remote, no login | CVSSCVSS: CVE-2026-123039 AV:L/PR:L/UI:N |
| Yes | Full takeover | CVSSCVE-2026-123039: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | Sources describe a backdoor and wiping ESXi files; no stolen or exposed secrets or data are reported. |
| No | Supply chain | Sources describe exploitation of gateways, not a compromised package, update, or build pipeline. |
| No | No fix yet | The Hacker News calls the gateways unpatched, but neither source says no fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-123039 ↗CVSS 7.8 high AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
- Exploited
- Not in CISA’s exploited catalog
- Weakness
- CWE-862, CWE-732
Timeline
Exploitation of Check Point gateways via PHP2Shell reported by The Hacker News and SecurityWeek
SecurityWeek
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
The Hacker News
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Full coverage · 2 sources
First seen · 2 sources · Full story page · How tiers are decided