A series of high-severity vulnerabilities in Check Point’s Secure Access Gateways has been exploited by hackers, who have successfully deployed a backdoor known as TSGA (Talos Shell) and wiped sensitive files from affected ESXi servers. The attacks highlight the importance of proactive security measures to prevent lateral movement and data exfiltration.
Check Point’s Gateways are widely used for secure access to remote networks, providing a layer of protection against unauthorized access and malicious activity. However, researchers have discovered that hackers have exploited a combination of flaws in PHP2Shell, an embedded PHP shell in the Check Point Secure Access Gateway, to gain unrestricted access to affected systems. This backdoor allows attackers to move laterally within the network, compromising sensitive data and potentially leading to further breaches.
The TSGA backdoor, specifically, grants hackers elevated privileges on the targeted system, allowing them to modify configurations, delete files, and install additional malware. In some cases, the hackers have even used this access to wipe sensitive files from ESXi servers, which could be a critical step in preparing for data exfiltration or other malicious activities. The full extent of the attacks is still unknown, but researchers suspect that thousands of Check Point Gateways may be at risk.
The PHP2Shell vulnerability itself stems from poor configuration and outdated software, allowing hackers to exploit the embedded shell and gain access to sensitive areas of the system. While this issue has been present for some time, the recent surge in attacks highlights the need for organizations to prioritize patching and updating their systems regularly. Furthermore, researchers emphasize that even if a vulnerability is patched, the presence of an existing backdoor can still pose a significant threat.
The TSGA backdoor and associated attacks demonstrate the importance of proactive security measures, including regular monitoring and logging, as well as robust incident response planning. By staying informed about emerging threats and taking swift action to address vulnerabilities, organizations can significantly reduce their exposure to lateral movement and data breaches. In light of these findings, we urge all Check Point Gateway users to review their configurations, update software immediately, and take steps to harden their systems against future attacks.
Ultimately, the recent TSGA backdoor attacks serve as a stark reminder that security is an ongoing process requiring constant vigilance and attention to detail. By prioritizing proactive measures and staying informed about emerging threats, organizations can better protect themselves from even the most sophisticated cyberattacks.
Source: The Hacker News — 2026-11-13