Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
MentionsCheck PointVMwareVMware ESXi
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave
Summary from The Hacker News.
Explained
The technology and terms in this story. Learn more
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Related coverage
Other sources covering the same vulnerabilities or event.