Hackers Broke Into Check Point Gateways Through PHP2Shell, Then Wiped a VMware ESXi Host

Hackers turned vulnerable Check Point gateways into a route to a VMware ESXi host, where they deployed software that deletes files. Check Point disclosed the intrusion on November 12, 13 days after the October 30 wave.

Its investigation describes an October 30 wave targeting Israeli organizations that included destructive activity at some victims. A wider November 2 wave reached multiple countries and sectors, without evidence of destruction in that second wave.

A firewall became the foothold

Attackers entered through Mobile Access portals using PHP2Shell, then exploited the DynamicCLI flaw CVE-2026-123039 to gain root privileges. They installed webshells and persistent backdoors before moving over SSH to the ESXi host and running the destroy_v6 wiper.

That takes the story beyond the PHP flaws and early attacks disclosed in October. Here, a compromised network gateway became a stepping stone to destructive activity inside the network.

Patches preceded the attacks

Check Point's separate security advisory says fixes were available on October 23, a week before the October 30 wave. It describes a couple of dozen compromised, unpatched systems in one region. The research report's broader scanning wave should not be read as a count of additional confirmed compromises.

The vendor recommends its November Jumbo Hotfix for Management Servers and Security Gateways, prioritizing internet-facing Mobile Access systems. It lists suspicious PHP session files, processes imitating Check Point components and unexplained firewall-log gaps among the signs worth investigating. An absent indicator does not rule out compromise.

The research links the backdoor tooling to PhiliKit, previously associated with a China-linked group, but stops short of confidently attributing the operation. Political notes left during the destructive phase do not settle who carried it out or why.

The disclosed chain ends with a security appliance serving as the route to a separate host's destruction. Installing an update and determining what an intruder already reached remain separate jobs.

Some offers on this page may be paid placements or contain affiliate links.