Check Point Security Gateways Hit by PHP2Shell Exploits to Deliver ESXi Wiper Malware

What happened

BleepingComputer reports that attackers have targeted vulnerable Check Point Security Gateway instances using a technique the report calls "PHP2Shell." According to the report, the compromised gateways were then used to deploy data-wiping malware against VMware ESXi hosts. The available summary does not name a specific vulnerability identifier, affected product versions, or the threat actor behind the campaign. This write-up does not assume any facts beyond what was reported.

Why it matters

Security gateways sit at the network perimeter. They are typically internet-facing and administratively privileged, which makes them a useful pivot point into internal infrastructure. Pairing initial access with an ESXi wiper is serious. Hypervisors often host many production VMs, so wiping one can cause broad, hard-to-recover outages rather than a single-host incident. Organizations running Check Point gateways alongside VMware ESXi should note that edge appliances and virtualization infrastructure can be chained together in destructive attacks.

What defenders should watch for now

• Review the exposure and patch status of internet-facing Check Point Security Gateway appliances. Confirm that management interfaces are not reachable from the internet unless required.
• Monitor gateway logs and web-facing components for anomalous requests, unexpected process spawns, or web shell indicators.
• Audit network paths between perimeter appliances and ESXi management interfaces such as vCenter, ESXi host management, and SSH. Segment and restrict these paths where possible.
• Watch ESXi hosts for unusual authentication, datastore access, or bulk file modification or deletion. Ensure VM backups are offline or immutable so a wiper cannot reach them.
• Validate incident response and recovery plans for hypervisor-level destructive events, not just endpoint ransomware.

Developing story

This report does not include an assigned CVE in the available summary, and key technical details such as the exact exploited flaw, affected versions, and attribution remain unconfirmed. We will continue to track this story as more information becomes available. Read the original report from BleepingComputer: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper.