Check Point gateways hit by PHP2Shell attacks and TSGA backdoor deployment
An unknown threat actor targeted unpatched Check Point Security Gateways to gain initial access through PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. Check Point said the activity began on October 30, 2026, first hit Israeli organizations, and then expanded on November 2, 2026, to organizations across multiple countries and sectors. Gateway intrusion and destructive follow-up Check Point…