PHP2Shell Exploited in Destructive Check Point Gateway Attacks

Threat actors exploited two PHP2Shell vulnerabilities in Check Point Gateway appliances to gain initial access, then chained a privilege escalation flaw to achieve root-level control and deploy wiper malware. The destructive nature of the payload — not just data theft but active destruction — amplifies the consequences of delayed patching on internet-facing security appliances. Security gateways are high-value targets precisely because they sit at the perimeter, and leaving them unpatched effectively hands attackers the keys to the network. This incident underscores that vulnerability management must prioritize internet-exposed infrastructure, especially devices marketed as security products, which organizations may incorrectly assume are inherently hardened.