Security · High impactFan score 66 · Tier A2 sources
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
The Hacker News ·
The Brief · written from 2 sources
- An unknown threat actor is exploiting unpatched Check Point Security Gateways via PHP2Shell vulnerabilities for initial access.
- Attackers then use a previously reported local privilege escalation flaw in Gaia OS, CVE-2026-123039, to gain root.
- The activity deploys a backdoor called TSGA and wipes ESXi files.
Why it matters
Organisations running unpatched Check Point Security Gateways face full compromise and destructive data loss, including on ESXi hosts reachable from the gateway.
Who’s affected
- Operators of Check Point Security Gateways running Gaia OS
- Teams with ESXi hosts behind Check Point gateways
What to do
- Apply available Check Point patches for the PHP2Shell vulnerabilities and the Gaia OS privilege escalation flaw
- Hunt for TSGA backdoor indicators and review gateway logs for signs of compromise
- Verify backups of ESXi hosts are current and offline-protected
- CVE-2026-123039
- #security
- #check-point
- #php2shell
- #backdoor
- #privilege-escalation
- #esxi
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity…
Timeline
Exploitation of Check Point gateways via PHP2Shell reported by The Hacker News and SecurityWeek
SecurityWeek
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
The Hacker News
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files