GoKawiilCheck Point gateway flaws chained to deploy ESXi wiper in Israel-linked attacks
Attackers exploited a pair of critical PHP flaws dubbed PHP2Shell, along with a new Check Point zero-day (CVE-2026-123039), to breach Security Gateway appliances and escalate to root access. Starting October 30, they first struck Israeli organizations and then expanded globally on November 2, installing webshells and a TSGA backdoor before using network scanning tools to pivot into VMware ESXi hosts and deploy a destructive wiper called destroy_v6.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign shows how quickly newly patched PHP vulnerabilities, exploited even before CISA's public warning, can be weaponized for destructive attacks against virtualization infrastructure. Researchers note political messages left during the wiping stage, which could indicate a hacktivist motive or, as they suggest, a deliberate false-flag operation designed to obscure the true attacker's identity.
- PHP2Shell (CVE-2026-109618/109619) exploitation began before patches were public and before CISA's KEV listing.
- A separate Check Point zero-day (CVE-2026-123039) allowed privilege escalation to root on gateway appliances.
- The attack chain ended with a custom wiper, destroy_v6, deployed against VMware ESXi hosts.
Source: bleepingcomputer.com, 2026-11-13
Published there as: “Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.