Check Point Gateways Under Attack via PHP2Shell
A previously unknown threat actor has been exploiting unpatched Check Point Security Gateways, chaining the so-called PHP2Shell vulnerabilities with a newly disclosed local privilege escalation (LPE) flaw in Gaia OS to gain control of edge devices and deploy a custom backdoor tracked as TSGA.
According to research published by Check Point and reported by The Hacker News, the campaign began on October 30, 2026. The initial wave focused on Israeli organizations, and investigators observed a broader follow-up phase indicating the operation was not a one-off intrusion but part of a sustained campaign.
Anatomy of the Attack Chain
The intrusion follows a multi-stage pattern typical of edge-device compromises, where internet-facing appliances are abused as a foothold into the internal network:
- Initial access — The actor exploits the PHP2Shell flaws to execute code on exposed Check Point Security Gateway management interfaces.
- Privilege escalation — A previously unreported LPE vulnerability in Gaia OS, Check Point's underlying operating system, is used to elevate from the web-facing component to root-level control of the appliance.
- Persistence — The TSGA backdoor is installed to maintain durable access to the gateway, surviving reboots and blending into legitimate device activity.
- Impact — The actor was observed wiping files on ESXi hosts, a destructive step that can take down virtualization infrastructure and complicate recovery.
Because the entry point is the gateway itself — a device organizations rely on for perimeter defense — the compromise is particularly dangerous. A backdoored security appliance can be used to observe, redirect, or selectively allow traffic, undermining trust in the very control meant to protect the network.
Why Edge Devices Remain a Prime Target
Security gateways, VPN concentrators, firewalls, and load balancers share a set of characteristics that make them attractive to intrusion sets: they sit directly on the internet, they are frequently exempt from endpoint detection tooling, they hold privileged network positions, and their firmware and management planes are often updated on slower cycles than traditional servers.
The PHP2Shell chain illustrates a recurring pattern in which a web-layer flaw is paired with a local privilege escalation to achieve full device compromise. Attackers rarely need a single critical bug when they can combine a moderate remote flaw with a local elevation step. The Gaia OS LPE being previously unreported suggests the actor either discovered it independently or held it in reserve specifically for this operation.
The destructive handling of ESXi files also fits a broader trend in which intrusion sets move from espionage to sabotage once access is established, targeting hypervisor storage because of the outsized operational impact.
Defensive Guidance
Check Point has published details of the activity along with remediation guidance. Organizations running Check Point Security Gateways should treat the disclosure as urgent. Recommended actions include:
- Patch immediately. Apply the vendor's fixes for the PHP2Shell flaws and any Gaia OS updates addressing the privilege escalation. Verify the installed build version rather than assuming automatic updates completed.
- Restrict management access. Limit gateway management interfaces to dedicated administrative networks or VPN-only reachability. Internet-exposed management planes are the primary enabler of this campaign.
- Hunt for TSGA artifacts. Review gateway file systems, startup scripts, scheduled tasks, and outbound connections for indicators published by Check Point. Edge appliances should be examined for unexpected binaries and configuration changes.
- Audit ESXi infrastructure. Check virtualization hosts for deleted or altered VM files, unexpected snapshot changes, and anomalous access from management networks.
- Reset credentials and rotate secrets. Assume that credentials stored or transiting a compromised gateway were exposed, including administrative accounts, API keys, and VPN material.
- Review logs for the October 30 window and beyond, focusing on authentication anomalies, unusual process execution on Gaia OS, and configuration exports.
The Bigger Picture
This campaign reinforces a lesson that defenders have learned repeatedly over the past several years: perimeter appliances are not just infrastructure, they are high-value targets that require the same patch discipline, monitoring, and incident response planning as any server. An attacker who owns the gateway owns the vantage point from which the rest of the network is defended.
For organizations in Israel and the surrounding region, the timing and targeting warrant heightened vigilance. For everyone else, the campaign is a reminder that chained vulnerabilities — a remote flaw plus a local escalation — can turn a single unpatched appliance into a full network compromise and, in this case, a destructive event on virtualization storage.
Check Point's advisory should be consulted for the authoritative list of affected versions, indicators of compromise, and fixed builds.
