Security · High impactFan score 66 · Tier A2 sources
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
SecurityWeek · By Ionut Arghire ·
The Brief · written from 2 sources
- An unknown threat actor is exploiting unpatched Check Point Security Gateways via PHP2Shell vulnerabilities for initial access.
- Attackers then use a previously reported local privilege escalation flaw in Gaia OS, CVE-2026-123039, to gain root.
- The activity deploys a backdoor called TSGA and wipes ESXi files.
Why it matters
Organisations running unpatched Check Point Security Gateways face full compromise and destructive data loss, including on ESXi hosts reachable from the gateway.
Who’s affected
- Operators of Check Point Security Gateways running Gaia OS
- Teams with ESXi hosts behind Check Point gateways
What to do
- Apply available Check Point patches for the PHP2Shell vulnerabilities and the Gaia OS privilege escalation flaw
- Hunt for TSGA backdoor indicators and review gateway logs for signs of compromise
- Verify backups of ESXi hosts are current and offline-protected
- CVE-2026-123039
- #security
- #check-point
- #php2shell
- #backdoor
- #privilege-escalation
- #esxi
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. The post PHP2Shell Exploited in Destructive Check Point Gateway Attacks appeared first on SecurityWeek .
Timeline
Exploitation of Check Point gateways via PHP2Shell reported by The Hacker News and SecurityWeek
SecurityWeek
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
The Hacker News
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Full coverage · 2 sources
- 2h ago ↗
The Hacker News
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files - 2h ago ↗
SecurityWeek
PHP2Shell Exploited in Destructive Check Point Gateway Attacks