Check Point PHP2Shell Vulnerabilities Weaponized for TSGA Backdoor Deployment

Between late October and early November 2026, an unidentified threat actor exploited a chain of known vulnerabilities in Check Point Gaia OS to compromise enterprise security gateways across Israeli organizations, with reported spillover to other regions. The attack sequence began with PHP2Shell, a set of remote code execution flaws in Check Point's web management interface that allow unauthenticated access. Once initial code execution was achieved, the attacker leveraged a separate privilege escalation vulnerability in Gaia OS to move from the web interface context to root-level system access. This progression from remote access to system-level control enabled the deployment of TSGA, a previously undocumented backdoor that gave attackers sustained presence on compromised devices.

Check Point released vulnerability advisories and patches for PHP2Shell in earlier 2026, but organizations that delayed patching or lacked visibility into their gateway inventory remained exposed. The attacker appears to have used public security research and proof-of-concept code to identify and target unpatched instances at scale, suggesting a opportunistic rather than highly targeted initial phase.

TSGA is a backdoor designed to run with root privileges on compromised Check Point gateways and hypervisor environments. Beyond typical backdoor capabilities such as command execution and reverse shell access, TSGA includes logic to enumerate and wipe files on ESXi virtual machine hosts, suggesting intent to disrupt production infrastructure rather than quietly extract data. ESXi file destruction is a hallmark of destructive campaigns, where the attacker's goal is operational disruption or ransom through threat of business interruption.

The presence of ESXi-targeting functionality raises the risk profile of this campaign significantly. Check Point Security Gateways often sit at network boundaries and sometimes have visibility into or access to hypervisor management networks. An attacker with root access to a gateway can pivot laterally to ESXi hosts, and TSGA's ability to delete files on those hosts creates a rapid path to business outage. This differs markedly from campaigns focused on exfiltrating financial records or intellectual property; instead, it resembles the destructive malware behavior seen in state-backed operations or high-impact ransomware gangs.

The attack relied on chaining two separate vulnerabilities into a single compromise pathway:

1. PHP2Shell remote code execution flaws allowed an attacker to execute arbitrary PHP code through the Check Point web management console without authentication.
2. The Gaia OS privilege escalation flaw permitted code running as the web service user to escalate to root.
3. Once root access was obtained, the attacker deployed TSGA as a persistent backdoor via system startup mechanisms or scheduled tasks.

The most critical factor enabling this attack was delay in patching. Check Point released fixes for PHP2Shell in the first half of 2026, but enterprises with large gateway deployments or complex change-management procedures often lag behind patch releases by months. A single unpatched gateway in a critical network segment can become the entry point for a complete network compromise. The attacker did not need to identify a new zero-day; they simply exploited the gap between disclosure and remediation.

From a law-enforcement and cyber-attribution perspective, several details stand out. First, the targeting of Israeli organizations in October 2026 appeared concurrent with rising geopolitical tensions, suggesting possible state or state-aligned involvement, though Check Point and external analysts have not attributed the activity to a named group. Second, the destructive component (ESXi file wiping) indicates an attacker willing to cause economic damage rather than operate silently. Third, the timing of the initial wave suggests reconnaissance or opportunistic scanning for vulnerable gateways rather than manual targeting, meaning the campaign likely affected dozens or hundreds of organizations globally.

Such campaigns typically precede either destructive attacks, high-impact ransomware deployments, or intelligence gathering in preparation for further operations. Organizations that were compromised but not yet executed against face a window of time to detect and eradicate the backdoor before destructive actions resume.

A Check Point Security Gateway is rarely a high-visibility asset in enterprise operations monitoring. Teams focus on firewall rules and VPN access; many organizations do not maintain detailed inventories of gateway versions or patch status across geographically dispersed sites. An attacker with TSGA access to a gateway can remain undetected for weeks if the organization lacks centralized logging and behavioral analysis of gateway system activity. Early-warning signs include unexpected SSH or console access attempts, unusual outbound connections from gateway IP addresses, and changes to gateway configuration files or scheduled tasks.

ESXi logs should be monitored for unexpected file deletion events and privilege escalation attempts originating from gateway network segments. Organizations running Check Point gateways should assume that any instance still running unpatched PHP2Shell code has been scanned and potentially compromised, necessitating immediate patching and forensic review of logs dating back several months.

If your organization operates Check Point Security Gateways, the response sequence should follow this order:

1. Confirm the version and patch status of all Check Point gateways, including those at branch offices and disaster-recovery sites.
2. Apply the latest PHP2Shell patches and Gaia OS privilege escalation fixes immediately, starting with internet-facing or critical-path gateways.
3. Review gateway system logs and authentication records for the past 90 days for signs of unauthorized access or credential use.
4. Enable centralized logging of all gateway system events and configure alerts for suspicious process spawning or network connections.
5. Scan ESXi environments for unexpected file deletions, particularly in critical directories, and restore from known-good backups if destruction is confirmed.
6. Engage a forensic specialist or managed threat-response provider if you suspect compromise; TSGA may have left artifacts in startup scripts, cron jobs, or web server logs.

For security teams without dedicated Check Point expertise, Check Point's incident response guidance and official vulnerability advisories provide specific detection signatures and remediation procedures. Do not rely solely on vendor patches; assume that the attacker has already scanned your network and may have backdoors in place that persist across a single patch cycle.

Can PHP2Shell vulnerabilities be exploited remotely without authentication? Yes. PHP2Shell allows remote code execution through the Check Point web management interface without requiring valid credentials, making any internet-exposed gateway a potential entry point.

What does TSGA backdoor do after it's installed? TSGA runs with root privileges and can execute arbitrary commands, maintain persistent access, and specifically includes functionality to enumerate and delete files on ESXi hypervisors.

If my gateway is patched now, am I safe? Patching stops new compromises but does not remove existing backdoors. You must also review logs and forensically inspect your gateway for signs of prior compromise.

How long can TSGA remain undetected? TSGA can operate silently for months if your organization does not monitor gateway system activity, log authentication attempts, or track outbound connections from the gateway.

Should I assume my gateway was compromised if it was unpatched? Not automatically, but you should treat it as a high-risk asset, audit its configuration and logs thoroughly, and consider rebuilding it from trusted installation media as a precaution.

Source: The Hacker News