Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Attackers chain PHP2Shell flaws and CVE-2026-123039 in Check Point gateways to plant the TSGA backdoor, then wipe VMware ESXi hosts. Patch now.
What’s new: Attackers are exploiting Check Point Security Gateways to install a stealthy backdoor called TSGA and then destroy data on VMware ESXi hosts. Initial access comes through PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), followed by CVE-2026-123039 (CVSS 7.8), a missing-authorization bug in the DynamicCLI process that escalates privileges to root. The activity began on October 30, 2026, mainly against Israeli organizations, with a broader wave on November 2.
How the attack works
- TSGA backdoor: a passive Linux gateway implant deployed as “slot_CPconfigdaemon,” with a companion TSProxy component. It provides encrypted remote access, steals configuration, survives through backups and snapshots, injects into processes and tampers with firewall logs.
- ESXi wiping: the attackers moved to an ESXi host over SSH using the vpxuser service account and ran the destroy_v6 wiper, which zero-overwrites and recursively deletes files of any type, leaving a politically themed “DREAM_ANNEXATION.txt” note in each directory.
- Attribution: unclear. Some indicators overlap with PhiliKit, a toolkit ESET tied to the China-nexus group Armory Castle (formerly UNC5221), but Check Point says the evidence is not strong enough to attribute the campaign and has not ruled out a false flag.
Who’s affected
Organizations running Check Point versions R82.20, R82.10, R82, R81.20, R81.10 and R81 on Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator.
What to do
- Apply the Check Point fix referenced in advisory sk1000362. It was released about a week before the attacks began, so unpatched gateways are the main exposure.
- Hunt for PHP web shells and TSGA artifacts (slot_CPconfigdaemon, TSProxy) on gateways, and treat firewall logs on suspect devices as untrustworthy.
- Review ESXi hosts for unexpected SSH sessions from the vpxuser account and for signs of the destroy_v6 wiper, and confirm you have offline backups.
