Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

An unknown threat actor has been targeting unpatched Check Point Security Gateways, exploiting PHP2Shell vulnerabilities to gain initial access and a local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. This campaign, which began on October 30, 2026, initially targeted Israeli organizations and then expanded globally, affecting multiple sectors. The attackers also deployed wiper malware on VMware ESXi hosts, leaving politically themed notes in some cases, suggesting a potential false-flag operation.

The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on vulnerable systems. These flaws were fixed by PHP in emergency patches on October 21, 2026. However, exploitation attempts reportedly started four days earlier. The attackers used these vulnerabilities to gain access through the Mobile Access portal of Check Point Security Gateways, before exploiting a newly disclosed zero-day privilege escalation flaw, CVE-2026-123039, to gain root privileges.

Once inside, the attackers installed PHP web shells and the TSGA backdoor, which includes a networking component called TSProxy. This backdoor allows encrypted remote access and configuration theft, among other capabilities. The attackers then moved from the compromised gateway to VMware ESXi hosts, deploying a data wiper known as destroy_v6. This wiper recursively deletes data and supports a fast mode that skips data overwriting, making recovery more difficult.

Check Point has linked TSGA and TSProxy to PhiliKit, a malware framework previously associated with the Chinese threat group Armory Castle. However, the evidence is not sufficient to conclusively attribute the campaign to this group or any other known threat actor. The politically themed notes left by the attackers raise further questions about their true intentions, with scenarios ranging from a false-flag operation to a mere distraction from other activities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded by adding CVE-2026-123039 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the patch by November 16, 2026. Check Point has released emergency hotfixes and advises customers to install the November Jumbo Hotfix on all affected Management Servers and Security Gateways, prioritizing those with internet-facing Mobile Access portals.

Administrators are urged to check for signs of compromise, such as unexpected CPconfigdaemon processes, unexplained gaps in firewall logs, and unauthorized SSH activity from the gateway to internal VMware ESXi hosts. Indicators of compromise (IOCs) provided by Check Point can assist in identifying affected systems and mitigating further risks.