Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

An unknown threat actor exploited the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) in unpatched Check Point Security Gateways to gain initial access, then used a local privilege escalation flaw (CVE-2026-123039) in Gaia OS to deploy the TSGA backdoor and establish persistent access. The attackers deployed PHP web shells, moved laterally to VMware ESXi hosts via SSH, and executed the destroy_v6 wiper malware to delete files and leave politically themed notes. The campaign targeted Israeli organizations initially, then expanded globally, with some evidence suggesting possible ties to the China-nexus group Armory Castle, though attribution remains uncertain due to the use of wiper malware and political messaging.

AI-extracted · verify before operational use