Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Ravie LakshmananNov 13, 2026Vulnerability / Cyber Espionage An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave on November 2, 2026, that targeted organizations across multiple countries and sectors. Some of the organizations singled out in the first wave have also been at the receiving end of destructive actions that include the deployment of wiper malware. "PHP2Shell provided initial access, followed by privilege escalation through the DynamicCLI interface, tracked as CVE-2026-123039," Check Point said. "The attackers then deployed PHP web shells, the persistent TSGA backdoor, and its embedded TSProxy networking component." "The attackers pivoted from the gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed DREAM_ANNEXATION.txt notes during the destructive stage." CVE-2026-123039 (CVSS score: 7.8) is a missing authorization flaw that could enable privilege escalation to root in the DynamicCLI process, enabling any authenticated local user to run arbitrary commands by writing a single request to the socket. "The issue is a local privilege escalation and requires the attacker to already have local code execution on the appliance," Check Point said, adding it "observed an active exploit of this vulnerability against a couple of dozen customers." The issue impacts versions R82.20, R82.10, R82, R81.20, R81.10, and R81 of the following products - Multi-Domain Security Management and Multi-Domain Log Server "In late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways," Check Point said. "Evidence suggested some cases of a successful compromise, with exploitation activity consistent with PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619." After obtaining initial access, the unknown hacking group is said to have escalated privileges from the portal service account to root by weaponizing CVE-2026-123039 and deploying PHP web shells with an aim to establish persistent access. The web shells support command execution and file upload capabilities. The November 2, 2026, wave is said to have targeted some Israeli organizations that had already been targeted in the first wave, alongside other organizations worldwide, without demonstrating any specific geographic or sector preference, indicating an opportunistic initial-access effort. The access afforded by the web shell paves the way for TSGA, a standalone passive backdoor that also includes a second component called TSProxy. TSGA, deployed as slot_CPconfigdaemon, has been described as a Linux gateway implant with Check Point-specific functionality, offering encrypted remote access, configuration theft, backup and snapshot persistence, process injection, and binary firewall-log tampering. "[TSProxy's] injection code loads this library into selected appliance processes, where it intercepts networking functions to handle specially marked attacker connections while allowing ordinary traffic to continue," Check Point said. "This combines a persistent standalone backdoor with concealed access through existing appliance services." Some of the other post-exploitation actions observed are listed below - Deploying the gogo scanner on the gateway to discover internal assets and services across the network. Moving laterally to a VMware ESXi host over SSH by authenticating with the vpxuser service account. Staging a Linux ELF wiper called destroy_v6 and executing it. The malware recursively traverses the target directory and deletes all files regardless of their extension. It also attempts to overwrite files with zeros before deleting them. Dropping a note named "DREAM_ANNEXATION.txt" in each processed directory. Both TSGA and TSProxy are assessed to be Check Point-specific components of a toolkit dubbed PhiliKit that was first documented by ESET in June 2026, attributing it to a China-nexus cyber espionage group tracked as Armory Castle (formerly UNC5221). Other factors that point to the involvement of a possible China-aligned threat actor include the use of LightNode VPS infrastructure and the fact that scanning activity was concentrated between 12 and 9 a.m. UTC, coinciding with typical Chinese working hours. However, the cybersecurity company said it does not have enough evidence to link the latest campaign to the threat actor or other known Chinese-nexus groups, citing the following reasons - Focus on Israel and explicit references to the Israeli-Palestine conflict in the wiper note "Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation," Check Point said. "Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation. It is also possible that the destructive activity served as a smoke screen." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, Data Destruction, Malware, network security, Vulnerability CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks The Flood is Coming And The Pipes Were Already Full Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk