Security · High impactFan score 67 · Tier A6 sources

Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

Security Affairs · By Pierluigi Paganini · 1d ago

The Brief · written from 6 sources

Unpatched Check Point Security Gateways were exploited via PHP2Shell flaws for initial access, with a previously reported local privilege escalation in Gaia OS used to gain root.
The attacks deployed the TSGA backdoor and a wiper that erased files on VMware ESXi hosts.
Check Point released emergency hotfixes; the exploitation reportedly began on 30 October.

Why it matters

Check Point gateways sit at network edges, so unpatched devices can give attackers root access, persistence and a path into internal networks. Destructive wiper activity against ESXi hosts can cause data loss and outages.

Who’s affected

Organisations running Check Point Security Gateways
Teams operating VMware ESXi hosts reachable from compromised gateways

What to do

Apply Check Point's emergency hotfixes to all Security Gateways
Check gateways for signs of compromise, including the TSGA backdoor and unexpected root persistence
Verify ESXi hosts and backups for wiper damage

CVE-2026-123039
#security
#check-point
#php2shell
#backdoor
#privilege-escalation
#wiper

Unpatched Check Point gateways were hacked worldwide, leading to root access, backdoors, network intrusion and destructive wiper attacks. Starting on 30 October, an attacker scanned and exploited Check Point Security Gateways that hadn’t been patched, going in through the Mobile…

Read the full story at securityaffairs.com ↗