Attackers Exploit PHP2Shell and Gaia OS Flaws in Check Point Gateways to Deploy TSGA ...

An unknown threat actor chained PHP2Shell bugs with a local privilege escalation flaw in Check Point Gaia OS to plant backdoors, move laterally, and wipe VMware ESXi systems. Check Point released details on the campaign, the affected products, and steps defenders can take.

Attackers exploited unpatched Check Point Security Gateways to gain initial access, escalate privileges to root, deploy a persistent backdoor, and destroy files on VMware ESXi hosts. Check Point reported the activity after investigators tracked two waves of intrusions that began on Oct. 30, 2026, and expanded on Nov. 2, 2026.

Two waves of intrusions

The first wave focused on Israeli organizations. Check Point found that activity from 130.94.19.204 targeted vulnerable Mobile Access portals on Check Point Security Gateways one week after a security fix became available. In some cases, the attackers compromised the appliances through flaws linked to PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619.

The second wave on Nov. 2 reached organizations across multiple countries and sectors. Attackers revisited some Israeli targets from the first wave and pursued additional victims worldwide. Check Point assessed the broader effort as opportunistic initial access rather than a campaign tied to a single region or industry. Several victims in the first wave also faced destructive actions.

Attack chain from portal access to root control

After the attackers gained access through PHP2Shell, they escalated privileges from the portal service account to root by exploiting CVE-2026-123039 in the DynamicCLI process of Gaia OS. Check Point assigned the flaw a CVSS score of 7.8 and described it as a missing authorization issue. The bug allows an authenticated local user to run arbitrary commands by writing a request to a socket.

"The issue is a local privilege escalation and requires the attacker to already have local code execution on the appliance," Check Point said. The company added that it "observed an active exploit of this vulnerability against a couple of dozen customers."

With root access, the attackers deployed PHP web shells to maintain control. These web shells supported command execution and file uploads. The operators then installed TSGA, a persistent backdoor, and its embedded networking component, TSProxy.

TSGA and TSProxy capabilities

Check Point described TSGA, deployed as slot_CPconfigdaemon , as a Linux gateway implant built for Check Point environments. The backdoor provides encrypted remote access, steals configuration data, persists through backups and snapshots, injects code into processes, and tampers with binary firewall logs.

TSProxy extends that access. "[TSProxy's] injection code loads this library into selected appliance processes, where it intercepts networking functions to handle specially marked attacker connections while allowing ordinary traffic to continue," Check Point said. The company characterized the pair as a combination of a standalone backdoor and concealed access through existing appliance services.

Check Point assessed TSGA and TSProxy as Check Point-specific components of PhiliKit, a toolkit that ESET documented in June 2026 and linked to Armory Castle, a China-nexus cyber espionage group also tracked as UNC5221.

Lateral movement and data destruction

After establishing a foothold on the gateway, the attackers scanned internal networks with the gogo scanner to discover assets and services. They moved laterally to a VMware ESXi host over SSH by authenticating with the vpxuser service account.

On the ESXi host, the attackers staged and ran a Linux ELF wiper called destroy_v6 . The malware traversed target directories, deleted files regardless of extension, and attempted to overwrite files with zeros before deletion. In each processed directory, the attackers dropped a note named DREAM_ANNEXATION.txt .

Attribution questions

Several clues point to a possible China-aligned operator. Check Point cited the overlap with PhiliKit, the use of LightNode VPS infrastructure, and scanning activity concentrated between 12 a.m. and 9 a.m. UTC, a window that aligns with typical working hours in China.

Other evidence complicates that assessment. The campaign included wiper malware, focused on Israel, and placed explicit references to the Israeli-Palestinian conflict in the wiper note. "Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation," Check Point said. The company outlined several possibilities: one actor ran the full campaign, an initial access broker handed off access, or a false-flag operation obscured responsibility. Check Point also noted that the destructive activity could have served as a smoke screen.

Affected Check Point products

CVE-2026-123039 affects versions R82.20, R82.10, R82, R81.20, R81.10, and R81 of these products:

Check Point Force Firewalls

Check Point Management and Log Servers

Multi-Domain Security Management and Multi-Domain Log Server

Practical steps for defenders

Organizations that run Check Point gateways can reduce exposure with focused action:

Apply available fixes: Prioritize patches for CVE-2026-123039 and the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Treat internet-facing Mobile Access portals as urgent.

Review gateways for compromise: Inspect appliances for unauthorized PHP web shells, unexpected binaries such as slot_CPconfigdaemon , abnormal process injections, and signs of firewall log tampering.

Audit privileged access paths: Monitor and restrict use of the vpxuser service account. Review SSH activity from gateways to VMware ESXi hosts and investigate unfamiliar authentication events.

Limit lateral movement: Segment management networks, restrict gateway-to-hypervisor communication, and block unnecessary internal scanning from security appliances.

Prepare for destructive activity: Maintain offline backups for ESXi hosts and critical configurations. Test recovery procedures so teams can restore systems if attackers deploy wipers.

Check Point's findings show how attackers can turn an exposed gateway into a path for persistence, espionage, and destruction. Rapid patching, gateway inspection, and tight controls on hypervisor access give defenders the strongest protection against this chain of activity.

Source : Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files , by The Hacker News , The Hacker News , Nov 13, 2026