[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi-9nutrdgAFy7HjtCPNNoQRz3MFH3nDw5diIG7tY7-w":3},{"article":4,"iocs":59,"watch_terms":81,"solutions":82,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"30107a5c-79bf-40ed-a691-b04284495b60","Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper","check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper-97c01e","Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]","Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks (CVE-2026-109618, CVE-2026-109619) beginning October 30, initially against Israeli organizations. Attackers chained the PHP flaws with a zero-day privilege escalation (CVE-2026-123039) to install webshells and the TSGA backdoor, then moved laterally to VMware ESXi hosts where they deployed the destroy_v6 data wiper. The first wave left political messages and rejected ransom negotiations, while a second wave on November 2 affected multiple countries; Check Point tentatively linked the malware to PhiliKit and the Chinese threat cluster UNC5221, though attribution remained uncertain.","Check Point gateways exploited via PHP2Shell to deploy ESXi wiper in targeted attacks","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcheck-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F26\u002FPHP.jpg","2026-11-13T16:21:43+00:00","2026-11-13T17:00:14.707859+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Check Point Security Gateway","product",{"name":21,"type":19},"VMware ESXi",{"name":23,"type":19},"PHP",{"name":25,"type":26},"Check Point","vendor",{"name":28,"type":29},"UNC5221","threat_actor",{"name":31,"type":32},"gogo scanner","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":33,"icon":35,"name":36,"slug":37},null,"Breaches","breaches",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":55},{"id":56,"icon":35,"name":57,"slug":58},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[60,64,66,69,72,75,78],{"type":61,"value":62,"context":63},"cve","CVE-2026-109618","Critical PHP flaw enabling unauthenticated RCE on vulnerable Check Point gateways",{"type":61,"value":65,"context":63},"CVE-2026-109619",{"type":61,"value":67,"context":68},"CVE-2026-123039","Zero-day privilege escalation vulnerability exploited in attacks",{"type":58,"value":70,"context":71},"TSGA","Backdoor deployed on compromised gateways with TSProxy networking component",{"type":58,"value":73,"context":74},"destroy_v6","Data wiper deployed on VMware ESXi hosts to recursively delete data",{"type":58,"value":76,"context":77},"TSProxy","Networking component embedded in TSGA backdoor for command concealment",{"type":58,"value":79,"context":80},"PhiliKit","Malware framework tentatively linked to TSGA and previous Ivanti attacks",[25,18,21],{"controls":83,"vendors":170},[84,112,141],{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,96,104],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":85,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":142,"name":143,"problem":144,"products":145},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[146,154,162],{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":163,"vendor_name":164,"vendor_logo":165,"product_slug":166,"product_name":167,"url":168,"description":169},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[171],{"slug":172,"name":25,"logo_path":173,"roles":174},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[175,176],"affected","reported_by",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":187},"unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure","Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure","Attackers exploited two known PHP vulnerabilities in Check Point Security Gateway appliances and chained them with a zero-day privilege escalation to gain deep footholds — ultimately deploying a destructive wiper against VMware ESXi hosts. The incident illustrates how a single unpatched internet-facing appliance can serve as a launchpad for lateral movement into the most critical layers of infrastructure. Security gateways are high-value, high-exposure targets precisely because they sit at the perimeter, yet they are frequently behind on patches due to concerns about downtime. The deployment of the destroy_v6 wiper underscores that some threat actors have no interest in negotiation — their goal is irreversible destruction, making rapid detection and isolation essential.",[182,183,184,185,186],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":188,"NIST SP 800-53 SI-2: Flaw Remediation":189,"NIST SP 800-53 SC-7: Boundary Protection":190,"CIS Control 12: Network Infrastructure Management (v8)":191,"CIS Control 7: Continuous Vulnerability Management (v8)":192},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling; operators of Check Point gateways were obligated to track and remediate known vulnerabilities in security-critical network appliances before they were weaponized.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; a formal flaw remediation process for the known PHP vulnerabilities would have prevented their exploitation as the attack's initial vector.","SC-7 mandates monitoring and controlling communications at external boundaries and between internal network segments; proper boundary controls would have blocked lateral movement from the compromised gateway to ESXi management interfaces.","CIS Control 12 calls for segmenting and controlling access between network layers; enforcing strict segmentation between the perimeter gateway and VMware ESXi management interfaces would have prevented lateral movement from the compromised gateway to the hypervisor hosts.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in internet-facing assets; timely patching of the PHP flaws in Check Point gateways would have closed the initial entry point before attackers could chain them with the zero-day."]