Check Point links PHP2Shell attacks to ESXi file wiper

Unknown threat actors were observed targeting unpatched Check Point Security Gateways to gain initial access via the PHP2Shell vulnerabilities and then exploit a local privilege escalation flaw in Gaia OS to deploy a backdoor named TSGA. Check Point’s analysis links the campaign, which began on 30 October 2026 with an Israeli focus and a second wave on 2 November 2026 affecting organisations across several countries and sectors.

Evidence from Check Point indicates several compromises occurred, with PHP2Shell activity followed by privilege escalation, deployment of PHP web shells, the persistent TSGA backdoor, and an embedded TSProxy component.

The privilege escalation is tied to CVE-2026-123039, described as a missing-authorization flaw that could enable root access via the DynamicCLI process. Check Point notes the flaw is local to already-authenticated access and observed exploits against a number of customers. The affected product versions span Check Point Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, and Maestro Orchestrator across R82.20, R82.10, R82, R81.20, R81.10 and R81 releases.

After initial access, attackers pivoted from the gateway to a VMware ESXi host via SSH, deployed a Linux ELF wiper named destroy_v6 that deletes files and overwrites with zeros, and left a DREAM_APPENDIX.txt note in processed directories, while launching TSGA (slot_CPconfigdaemon) and TSProxy for encrypted remote access, configuration theft and persistence.

Check Point’s investigation links TSGA/TSProxy to the PhiliKit toolkit, previously documented by ESET and attributed to a China-nexus group in some analyses, though the firm cautions it does not have conclusive evidence tying this operation to any specific actor.