Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Hackers exploit PHP2Shell flaws in Check Point Gateways to deploy TSGA backdoor.
An unknown threat actor is exploiting PHP2Shell vulnerabilities and a privilege escalation flaw in Check Point's Gaia OS to deploy the TSGA backdoor. The attacks, which began on October 30, 2026, have targeted Israeli organizations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Check Point Security Gateways?
Get an email when a new story names Check Point Security Gateways, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — TSGA