Attackers are chaining a patched PHP flaw with a brand-new root exploit on Check Point firewalls to plant a backdoor and, in some cases, wipe VMware ESXi servers entirely.
If your business, or your IT provider, uses a Check Point Security Gateway as a perimeter firewall, there is an active attack campaign you need to know about today. Check Point Research has confirmed in-the-wild exploitation of a vulnerability dubbed PHP2Shell, which is being chained with a brand-new privilege escalation flaw to take full control of gateways — and in some cases, destroy the virtual servers behind them.
What is actually happening
According to Check Point's own security advisory, attackers first exploit PHP2Shell, a flaw in PHP that also affects Check Point gateways, to gain initial access through the Mobile Access portal. From there, they use a newly disclosed local privilege escalation vulnerability, tracked as CVE-2026-123039, to obtain root privileges on the device, according to reporting from The Hacker News.
Once attackers have root, they deploy PHP web shells and install a persistent backdoor called TSGA, which comes with an embedded networking component named TSProxy. Check Point's threat research team describes the TSGA implant as offering encrypted remote access, theft of firewall configuration data, persistence through backups and snapshots, process injection, and the ability to tamper with firewall logs to cover tracks, as detailed in coverage from Lavx News.
In some confirmed cases, attackers did not stop at the firewall. Check Point's own research blog states that in Israeli victim environments, attackers pivoted from the compromised gateway to VMware ESXi hosts over SSH and deployed a destructive wiper, permanently destroying virtual machines rather than just stealing from them.
Why this matters right now
This is not a theoretical risk. Check Point confirmed that active exploitation began in late October 2026, targeting vulnerable Mobile Access portals roughly one week after a security fix for the underlying flaws became available. That is the pattern we keep seeing across this entire threat landscape: a patch ships, and attackers reverse-engineer it faster than organizations apply it. Check Point has so far observed active exploitation against a couple of dozen customers, but given how widely Check Point gateways are used as perimeter firewalls by SMEs and the IT providers who manage them, the real exposure is almost certainly broader than what has been publicly confirmed.
A firewall is supposed to be the thing standing between your network and the internet. When the firewall itself becomes the entry point, and the attacker can then reach into your virtualization layer and destroy entire servers, the business impact goes well beyond a data breach — it is a continuity risk.
What to do today
- Check your patch level. Confirm your Check Point Security Gateways, especially anything running the Mobile Access portal, are fully patched against CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039, as instructed in Check Point's advisory.
- Restrict exposure now, even before patching finishes. If the Mobile Access portal does not need to be reachable from the open internet, restrict it to known IP ranges or a VPN while you confirm patch status.
- Hunt for signs of compromise. Look for unauthorized PHP web shells and any trace of the TSGA or TSProxy backdoor. Check Point's advisory includes specific indicators — don't assume a clean patch means a clean system if the device was already exposed.
- Review firewall logs for tampering. Because TSGA can alter logs, a "quiet" log history is not automatically reassuring. If you have external log storage or a SIEM, cross-check against it.
- Check your VMware ESXi exposure. If your firewall and your virtualization hosts share network paths, especially SSH access, segment them. Confirm backups of VMs exist and are stored somewhere the attacker chain above could not reach.
The bigger picture
This is the fourth perimeter-device attack we have covered in the past week alone — Citrix, SonicWall, Barracuda, and now Check Point. Firewalls and VPN gateways sit exactly where attackers want to be: at the edge, trusted, and often under-monitored. We will keep watching this space and reporting on what Swiss SMEs need to patch, check, or switch off, because this is now simply part of the daily operating reality for any business running IT infrastructure.
If you don't have the internal capacity to track every advisory like this one and verify your own exposure, that is exactly the kind of ongoing work The Mejlerö Company (Flitz.ai) supports for businesses in Obwalden, Nidwalden, Lucerne and Zurich — from checking firewall and endpoint security basics to setting up two-factor authentication and structured network management. A free network analysis and a free one-hour consultation are a reasonable place to start if you are unsure where your business currently stands.
Switzerland.