Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

An unknown threat actor has been observed targeting unpatched Check Point Security Gateways, exploiting PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a previously unreported local privilege escalation flaw (CVE-2026-123039) in Gaia OS. The attackers are deploying a backdoor called TSGA and, in some cases, wiper malware. The activity, detailed by Check Point, began in late October 2026, initially targeting Israeli organizations, with a broader wave on November 2, 2026, affecting organizations across multiple countries and sectors.