PHP2Shell Exploitation on Check Point Gateway

Attackers exploited unpatched Check Point Security Gateways — devices that sit at the perimeter and are often trusted implicitly — to gain initial access and then pivot laterally to VMware ESXi hosts where a destructive wiper was deployed. The root cause is a failure to apply available patches to internet-facing network appliances, compounding the risk by allowing the gateway itself to serve as a launchpad deeper into the environment. This attack illustrates that security appliances are high-value targets precisely because they carry elevated trust and network access, yet are frequently overlooked in patching cycles. The deployment of a wiper underscores that delayed detection and inadequate network segmentation can turn an initial intrusion into an irreversible data-destruction event.