Unpatched Check Point Gateways Hit by Backdoor and ESXi Wiper
Attackers breached unpatched Check Point gateways via PHP2Shell, escalated privileges in Gaia OS (CVE-2026-123039) and planted the TSGA backdoor.
⚡ Why it matters
A security gateway guards the whole network; if it falls, everything behind it is exposed. In some cases the attacks ended with files wiped on VMware ESXi servers, meaning disruption, not just data theft.
Check Point says an unknown threat actor has targeted unpatched Check Point Security Gateways. The attackers gained a foothold through flaws known as PHP2Shell, then exploited a previously unknown local privilege escalation bug in Gaia OS and installed a backdoor the company named TSGA.
According to reports, the activity began on October 30, 2026, initially targeting Israeli organizations before a broader wave followed. In some cases, the access was used to wipe files on VMware ESXi servers.
The privilege escalation flaw in CISA's catalog
On November 13, CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog. According to the agency, the DynamicCLI service in Gaia OS runs as root and listens on a world-writable local socket without verifying connecting processes, allowing an authenticated local user to run commands as root. Federal agencies were given until November 16 to patch.
What to do
- Apply the latest Check Point updates for your Gaia version immediately, and read the company's advisory on the incident.
- Check gateways for the published indicators of compromise, especially the TSGA backdoor.
- Restrict administrative access to the gateways, and make sure you have offline backups of your ESXi servers.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.