Check Point Gateways Wiped via PHP2Shell Chain as CISA Adds Flaws to KEV

Check Point gateways exploited via PHP2Shell and CVE-2026-123039 to deploy TSGA backdoor and ESXi wiper; CISA adds KEV entries.

Attackers are exploiting unpatched Check Point Security Gateways through the Mobile Access portal using the PHP2Shell exploit chain plus CVE-2026-123039 to gain root, then deploying the TSGA backdoor and data-wiping malware on VMware ESXi hosts.
Any district, school board or agency exposing gateway management or remote-access portals to the internet is in scope; the campaign has been observed worldwide since 30 October.
CISA added CVE-2026-123039 and the UnrealIRCd flaw CVE-2026-114713 to its Known Exploited Vulnerabilities catalog on 13 November, making both mandatory remediation priorities.

What to do now

1. Inventory every Check Point Security Gateway and Mobile Access portal today, record firmware/Gaia OS version and owner, and flag anything reachable from the internet for immediate action.
2. Apply the current Check Point hotfixes and Gaia OS updates covering CVE-2026-123039 and the PHP2Shell issues; where patching must wait, disable unused Mobile Access features and restrict the portal to approved networks only.
3. Hunt for compromise from 30 October onward: new or changed administrative accounts, altered gateway configuration, unexpected processes, TSGA backdoor artefacts, and ESXi anomalies such as mass file deletion, snapshot removal or datastore corruption.
4. Isolate suspected gateways and ESXi hosts, preserve logs and disk/memory images, then rotate all credentials, API keys, certificates and SSH keys tied to gateway and vSphere management before rebuilding.
5. Restrict vSphere/ESXi management to a hardened management VLAN or jump host, enable lockdown mode where feasible, validate offline or immutable backups, and test restoration before reconnecting anything to production.