Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

An unknown threat actor is exploiting vulnerabilities in PHP2Shell to gain initial access to unpatched Check Point Security Gateways. The actor then uses a local privilege escalation flaw in Gaia OS to deploy a backdoor known as TSGA. This activity, which started on October 30, 2026, has targeted Israeli organizations, and was followed by a broader wave of attacks. The TSGA backdoor deployment is accompanied by the wiping of ESXi files. Check Point has detailed this threat actor's activity. The attacks have been observed in a targeted campaign against Israeli organizations.