Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files

An unknown threat actor has targeted unpatched Check Point Security Gateways using the PHP2Shell vulnerabilities for initial access, then used a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. Check Point says the activity began on October 30, 2026, and targeted Israeli organizations, with some intrusions wiping ESXi files.