Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts.

Check Point gateways hit in PHP2Shell attacks, ESXi wiper deployed

Attackers exploited PHP2Shell flaws in vulnerable Check Point Security Gateways from 30 October, first hitting Israeli organizations before expanding globally on 2 November. The chain used the Mobile Access portal for entry, a root...

Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS  to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up