Check Point Gateways Turned Against Their Owners: PHP2Shell → TSGA Backdoor → ESXi Wiper — CVE-2026-123039 on CISA KEV
Nation-state linked attackers exploited two PHP2Shell vulnerabilities to enter Check Point gateway Mobile Access portals, escalated to root through a world-writable socket flaw (CVE-2026-123039), planted the TSGA backdoor, and wiped ESXi hosts with a destructive wiper. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13. If your gateway runs Mobile Access, your…