PHP2Shell to wiper: Check Point gateways chained to root and ESXi destruction

Check Point gateways chained PHP2Shell RCE with a Gaia OS root escalation, deploying a TSGA backdoor and an ESXi wiper. Patch and hunt now.

  • Attackers are chaining PHP2Shell remote code execution (CVE-2026-109618/109619) with a Gaia OS local privilege escalation (CVE-2026-123039) on unpatched Check Point Security Gateways.
  • Check Point reports a TSGA backdoor and data-wiping malware deployed against VMware ESXi hosts; CVE-2026-123039 is in CISA's Known Exploited Vulnerabilities catalog.
  • Any school or government network terminating VPN or edge traffic on Check Point, or running ESXi, should treat this as an active incident-response priority.

What to do now

  1. Inventory and label every Check Point Security Gateway, Security Management Server, multi-domain management server and Gaia OS host; prioritize internet-facing gateways and shared management or jump hosts.
  2. Apply Check Point hotfixes for the PHP2Shell CVEs and the Gaia OS update for CVE-2026-123039; confirm fixed versions in the vendor advisory, then restrict DynamicCLI and management access to approved admin networks and audit local accounts.
  3. Hunt for TSGA and wiper staging: unexpected admin accounts, configuration changes, gateway restarts, mass file deletion or snapshot removal on ESXi; isolate suspected hosts and preserve logs, memory and disk before rebuilding.
  4. Protect ESXi: restrict vSphere management interfaces, enable lockdown mode where feasible, validate offline or immutable backups and test restoration before reconnecting systems.
  5. Rotate credentials, API keys, certificates and sessions tied to gateways and ESXi; separately patch Apache HTTP/2 CVE-2026-119618 on web servers and confirm with WordPress hosting providers whether HTTP/2 is exposed.

Related items