Check Point reports gateway exploit chain used to deploy backdoors and wipers

Check Point has disclosed attacks that chained PHP2Shell vulnerabilities in unpatched Security Gateways with a previously unreported Gaia OS flaw to install persistent backdoors. The company said it observed active exploitation of the privilege escalation vulnerability, CVE-2026-123039, against a couple of dozen customers. The campaign began October 30 and expanded across countries and sectors on November 2. Attackers used the TSGA backdoor and TSProxy component to conceal remote access through appliance services. In some initially targeted Israeli organizations, attackers moved to VMware ESXi hosts over SSH and deployed malware that overwrites and deletes files. The Gaia OS flaw requires existing local code execution. Check Point said it lacked enough evidence to attribute the campaign confidently.