#3
The Hacker News
general
November 13, 2026 at 08:05 UTC
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
By [email protected] (The Hacker News)
AI Summary
An unknown threat actor began October 30, 2026, exploiting unpatched Check Point Security Gateways via PHP2Shell vulnerabilities combined with CVE-2026-123039, a local privilege escalation flaw in Gaia OS, to deploy a backdoor called TSGA and subsequently wipe VMware ESXi files. Initial targeting focused on Israeli organizations before broadening. Security teams running Check Point gateways should apply emergency hotfixes immediately and audit ESXi hosts for signs of data destruction.
Relevance score: 88.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →