# Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

Source: [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html) · 2026-11-13 · Security
Page: https://themorning.dev/story/hackers-exploit-php2shell-flaws-in-check-point-gateways-to-deploy-tsga-backdoor-c0eea237828e0534
Kind: security · Impact: high

## In brief

- An unknown threat actor is exploiting unpatched Check Point Security Gateways via PHP2Shell vulnerabilities for initial access.
- Attackers then use a previously reported local privilege escalation flaw in Gaia OS, CVE-2026-123039, to gain root.
- The activity deploys a backdoor called TSGA and wipes ESXi files.

## Why it matters

Organisations running unpatched Check Point Security Gateways face full compromise and destructive data loss, including on ESXi hosts reachable from the gateway.

## What to do

- Apply available Check Point patches for the PHP2Shell vulnerabilities and the Gaia OS privilege escalation flaw
- Hunt for TSGA backdoor indicators and review gateway logs for signs of compromise
- Verify backups of ESXi hosts are current and offline-protected

## CVEs

- CVE-2026-123039

## Timeline

- 2026-11-13: Exploitation of Check Point gateways via PHP2Shell reported by The Hacker News and SecurityWeek

## Coverage

- [Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files](https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html) — The Hacker News, 2026-11-13
- [PHP2Shell Exploited in Destructive Check Point Gateway Attacks](https://www.securityweek.com/php2shell-exploited-in-destructive-check-point-gateway-attacks/) — SecurityWeek, 2026-11-13

Tags: security, check-point, php2shell, backdoor, privilege-escalation, esxi

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev