Attackers exploit Check Point gateway flaws to deploy TSGA and wipe ESXi
Original title: Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Activity began October 30 against Israeli organizations, then widened November 2, using CVE-2026-123039 after PHP2Shell access.
Check Point reported an unknown actor exploiting unpatched Security Gateways through PHP2Shell, then escalating with a Gaia OS DynamicCLI flaw, CVE-2026-123039, to install PHP web shells and the TSGA backdoor with TSProxy. Activity began October 30, 2026 against Israeli organizations, followed by a broader wave on November 2. Some first-wave victims also had an ESXi host wiped with destroy_v6 and notes named DREAM_ANNEXATION.txt. Check Point said it cannot assess the operation’s nature with high confidence.
Unconfirmed: Check Point says evidence is insufficient to attribute the campaign to Armory Castle or another China-nexus group.
- CVE-2026-123039 is a missing-authorization flaw scored CVSS 7.8 that escalates to root.
- Named affected releases are R82.20, R82.10, R82, R81.20, R81.10, and R81.
- Initial access is associated with CVE-2026-109618 and CVE-2026-109619.
- Check Point observed active exploitation against a couple of dozen customers.
- TSGA and TSProxy are assessed as Check Point-specific components of PhiliKit.
Impact: gateway root access, persistence, and ESXi file wiping
| Product | Affected |
|---|---|
| Check Point Force Firewalls | R82.20, R82.10, R82, R81.20, R81.10, and R81 |
| Check Point Management and Log Servers | R82.20, R82.10, R82, R81.20, R81.10, and R81 |
| Check Point Multi-Domain Security Management and Multi-Domain Log Server | R82.20, R82.10, R82, R81.20, R81.10, and R81 |
| Check Point Maestro Orchestrator | R82.20, R82.10, R82, R81.20, R81.10, and R81 |
- 1.Apply the available security fix to unpatched Check Point Security Gateways.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSHT1485 Data Destruction
- Vendors
- Check PointVMware
- Organizations
- ESET
- Countries
- Israel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 130.94.19.204 | a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile |
From the original article
4 min read at thehackernews.com
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.