Summary

An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave

For more information, read the full story at the original source: The Hacker News ↗

Vulnerabilities in this story

• CVE-2026-109618 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-109619 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-123039 KEV · fix by 2026-11-16 checkpoint Quantum Security Gateway, checkpoint Quantum Security Management EPSS 1.2% 7.8High

Also reported by

• Network World: The firewall becomes the foothold: Attackers turn Check Point gateways against customers ↗
• Security Affairs: Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell ↗
• BleepingComputer: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper ↗
• SecurityWeek: PHP2Shell Exploited in Destructive Check Point Gateway Attacks ↗