GoKawiilCheck Point gateway flaws chained to deploy ESXi wiper in Israel-linked attacks
Attackers exploited a pair of critical PHP flaws dubbed PHP2Shell, along with a new Check Point zero-day (CVE-2026-123039), to breach Security Gateway appliances and escalate to root access. Starting October 30, they first struck Israeli organizations and then expanded globally on November 2, installing webshells and a TSGA backdoor before using network scanning tools to pivot into VMware ESXi hosts and deploy a destructive wiper called destroy_v6.