Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
Check Point gateways exploited via PHP2Shell to deploy ESXi wiper in targeted attacks
Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks (CVE-2026-109618, CVE-2026-109619) beginning October 30, initially against Israeli organizations. Attackers chained the PHP flaws with a zero-day privilege escalation (CVE-2026-123039) to install webshells and the TSGA backdoor, then moved laterally to VMware ESXi hosts where they deployed the destroy_v6 data wiper. The first wave left political messages and rejected ransom negotiations, while a second wave on November 2 affected multiple countries; Check Point tentatively linked the malware to PhiliKit and the Chinese threat cluster UNC5221, though attribution remained uncertain.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Check Point?
Get an email when a new story names Check Point, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited two known PHP vulnerabilities in Check Point Security Gateway appliances and chained them with a zero-day privilege escalation to gain deep footholds — ultimately deploying a destructive wiper against VMware ESXi hosts. The incident illustrates how a single unpatched internet-facing appliance can serve as a launchpad for lateral movement into the most critical layers of infrastructure. Security gateways are high-value, high-exposure targets precisely because they sit at the perimeter, yet they are frequently behind on patches due to concerns about downtime. The deployment of the destroy_v6 wiper underscores that some threat actors have no interest in negotiation — their goal is irreversible destruction, making rapid detection and isolation essential.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619
- cve — CVE-2026-123039
- malware — TSGA
- malware — destroy_v6
- malware — TSProxy
- malware — PhiliKit