Check Point gates down in PHP2Shell attacks, ESXi backup deployed.
The attackers exploited PHP2Shell flaws in Check Point's vulnerable security gateways from October 30, first targeting Israeli organizations before expanding globally on November 2. The network used the mobile access portal for login, a root escalation tracked as CVE-2026-123039, then PHP webshells and the TSGA backdoor before moving to VMware ESXi hosts and deploying the destroy_v6 data wiper.
The campaign introduces a perimeter path to the hypervisor, with persistence at the gateway followed by destructive action against virtualization infrastructure. Reported indicators include upload_progress_pwn executables, unexpected CPconfigdaemon processes, firewall log gaps, and unauthorized SSH gateways to internal ESXi hosts.
Open sources - closed narratives.