According to The Hacker News, a previously unreported security breach involving Check Point Security Gateways has been identified, revealing how attackers are leveraging known vulnerabilities to establish persistent access within corporate networks. The incident, initially detailed by Check Point researchers, highlights a sophisticated campaign that began on October 30, 2026, primarily targeting organizations located in Israel. Following the initial wave of attacks, threat actors expanded their operations to include broader follow-up activities across other regions.
The exploitation chain begins with the abuse of PHP2Shell vulnerabilities present in unpatched Check Point systems. These flaws allow unauthorized remote code execution, granting the attackers the initial foothold necessary to infiltrate the network. Once inside, the threat actor proceeds to exploit a separate, unpatched local privilege escalation flaw within the Check Point Gaia OS. This critical step enables the attacker to elevate their privileges to administrative levels, bypassing standard security controls.
With elevated access secured, the malicious group deploys a custom backdoor known as TSGA. This tool facilitates long-term unauthorized access and allows for further malicious actions within the compromised environment. In addition to installing the backdoor, the attackers have been observed executing commands to wipe ESXi files. This destructive action suggests an intent to disrupt virtualized infrastructure or cover tracks, complicating forensic analysis and recovery efforts for affected victims.
Security experts emphasize that this campaign underscores the critical importance of applying all available patches for Check Point appliances. The combination of initial access via PHP2Shell and the privilege escalation flaw in Gaia OS creates a high-risk vector that can lead to complete system compromise. Organizations utilizing these gateways are urged to verify their patch status immediately to mitigate the risk of TSGA deployment and subsequent data loss or infrastructure disruption.
