[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faOkEwz7iyViKxg66-Z4qNiIImuabLxHFHLzrd0iR5G8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1a860a5f-44fb-400d-af38-9747d2847974","unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure","30107a5c-79bf-40ed-a691-b04284495b60","Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure","Attackers exploited two known PHP vulnerabilities in Check Point Security Gateway appliances and chained them with a zero-day privilege escalation to gain deep footholds — ultimately deploying a destructive wiper against VMware ESXi hosts. The incident illustrates how a single unpatched internet-facing appliance can serve as a launchpad for lateral movement into the most critical layers of infrastructure. Security gateways are high-value, high-exposure targets precisely because they sit at the perimeter, yet they are frequently behind on patches due to concerns about downtime. The deployment of the destroy_v6 wiper underscores that some threat actors have no interest in negotiation — their goal is irreversible destruction, making rapid detection and isolation essential.","**Immediate actions:**\n- Apply Check Point patches for CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039 immediately, or isolate affected gateways until patching is possible.\n- Audit all internet-facing Security Gateway instances for signs of webshell installation or unexpected outbound connections to ESXi management interfaces.\n- Restrict management access to VMware ESXi hosts to dedicated, isolated administrative networks with no direct reachability from DMZ or gateway segments.\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on perimeter security appliances.\n- Implement network segmentation so that compromise of a perimeter gateway cannot provide direct routed access to hypervisor management planes.\n- Maintain immutable, offline backups of ESXi datastores and VM snapshots so wiper-based attacks cannot achieve total data destruction.\n\n**Detection measures:**\n- Deploy file-integrity monitoring and anomaly detection on security appliances to alert on unexpected file writes (e.g., webshells, new binaries) in web-accessible directories.\n- Monitor ESXi management interfaces for authentication events and administrative commands originating from non-administrative source IPs.\n- Enable centralized, tamper-resistant logging for all perimeter devices so attacker activity is preserved even if the appliance is subsequently wiped.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST SP 800-53 SC-7: Boundary Protection":20,"CIS Control 12: Network Infrastructure Management (v8)":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling; operators of Check Point gateways were obligated to track and remediate known vulnerabilities in security-critical network appliances before they were weaponized.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; a formal flaw remediation process for the known PHP vulnerabilities would have prevented their exploitation as the attack's initial vector.","SC-7 mandates monitoring and controlling communications at external boundaries and between internal network segments; proper boundary controls would have blocked lateral movement from the compromised gateway to ESXi management interfaces.","CIS Control 12 calls for segmenting and controlling access between network layers; enforcing strict segmentation between the perimeter gateway and VMware ESXi management interfaces would have prevented lateral movement from the compromised gateway to the hypervisor hosts.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in internet-facing assets; timely patching of the PHP flaws in Check Point gateways would have closed the initial entry point before attackers could chain them with the zero-day.","published","2026-11-13T17:20:43.524743+00:00","2026-11-13T17:20:43.507+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcheck-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper\u002F","check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper-97c01e","Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[45,48,52],{"slug":34,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":40,"name":53,"problem":54},"Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]