How Attackers Used PHP2Shell Flaws to Deploy TSGA Backdoor on Check Point Gateways

Starting October 30, 2026, an unidentified threat actor began exploiting known flaws in Check Point Security Gateways. The initial targets were Israeli organizations, but security researchers documented a broader follow-up wave suggesting expansion beyond the original scope. Check Point researchers published detailed findings after detecting the activity, revealing a coordinated multi-stage compromise that combined web application vulnerabilities with kernel-level privilege escalation.

The attackers did not rely on a single entry point. Instead, they chained together multiple known issues in a deliberate sequence: first gaining shell access via the PHP2Shell flaws in the gateway, then escalating privileges within Gaia OS, and finally deploying the TSGA backdoor to maintain long-term access. This methodical approach suggests planning and reconnaissance, not opportunistic scanning.

PHP2Shell refers to a family of flaws that allow an unauthenticated attacker to upload and execute arbitrary PHP code on affected Check Point gateways. The vulnerability typically exists in web interfaces used for management or user-facing services that fail to properly validate file uploads or filter user input before passing it to the PHP interpreter. Once code execution is achieved, the attacker operates with the privileges of the web server process, which is often a starting point for further compromise.

These flaws are not new; they have been known for months, which means patched systems should have been protected. The continued exploitation indicates that many organizations have not deployed security updates despite their availability. A gateway sitting behind a firewall may seem less critical to patch than a directly exposed server, but this assumption has proven dangerous in practice.

After obtaining shell access, the attackers leveraged a local privilege escalation vulnerability in Gaia OS, the operating system underlying Check Point gateways. This allowed them to escape the web server context and gain root-level control of the entire system. Once at this privilege level, they could install the TSGA backdoor, which is believed to be custom malware designed specifically for Check Point environments.

TSGA functions as a persistent mechanism for remote access and command execution. The name itself may derive from an acronym or internal reference used by the threat actor, though its full functionality has not been publicly disclosed in detail. What is known is that the backdoor can receive commands from an external attacker-controlled server, execute them, and exfiltrate results, essentially turning the gateway into a puppeted asset under attacker control.

Once a gateway was fully compromised, some attacks progressed to destroying data on connected infrastructure. Specifically, attackers were observed wiping files on ESXi hypervisors, which are virtual machine hosts commonly used in enterprise data centers. This destructive capability suggests that some victims may have had their gateways positioned to access virtualization infrastructure, either directly or through lateral movement from the compromised gateway.

The targeting of ESXi systems is significant because it implies the attackers' intent to maximize damage and prevent recovery. Destroying hypervisor data or snapshots can bring down entire virtual infrastructure, affecting hundreds of workloads simultaneously. This behavior also suggests that the campaign may have been motivated by destructive intent, espionage, or extortion, depending on the attacker's broader goals.

Check Point Security Gateways are among the most critical network access points in large organizations, which paradoxically makes them harder to patch. Operators fear downtime, compatibility issues, or disruption to security rules if an update goes wrong. This creates a window in which known flaws remain exploitable for months or years after patches are available.

The PHP2Shell vulnerabilities fit this pattern perfectly. Patches were issued, but adoption was slow, particularly in organizations with high-availability requirements or those that had not prioritized security gateway patching. The attacker group behind this campaign likely identified this gap through passive reconnaissance or prior knowledge of patch deployment lag times in target sectors.

This incident demonstrates that security gateways themselves can be compromised entry points, not just guardians of the perimeter. Once inside, attackers can pivot laterally to internal systems, steal credentials, or destroy infrastructure. Organizations that treat their gateways as fully trusted, patched appliances are particularly at risk if they have not applied updates within weeks of their release.

The campaign also highlights the importance of monitoring gateway activity and maintaining out-of-band access to critical infrastructure. If an attacker controls the security gateway, they may be able to hide their own traffic, cover their tracks, or intercept legitimate administrative actions. Network segmentation and monitoring systems that are physically or logically separate from the gateways can help detect such compromise.

If your organization runs Check Point Security Gateways, verify that all security patches released for PHP2Shell and Gaia OS privilege escalation flaws have been deployed. This may require coordinating with your infrastructure team to schedule maintenance windows if you have not yet patched. Check Point has published advisories with CVE numbers and patch versions; match your current gateway version against the advisory to confirm your status.

Beyond patching, implement the following measures.

1. Enable logging and alerting on gateway authentication attempts, particularly for administrative interfaces.
2. Review firewall rules to confirm that gateway management interfaces are not accessible from untrusted networks.
3. Segment your network so that compromise of a gateway does not immediately grant access to ESXi hosts or other critical systems.
4. Establish a separate monitoring system to detect unusual outbound connections from your gateway, which might indicate backdoor communication.

Source: The Hacker News