Check Point gateways hit by PHP2Shell attacks that deploy backdoors and ESXi wiper

Feeds.4Sysops •IT News • November 14, 2026

Attackers have chained PHP2Shell with a newly disclosed privilege-escalation flaw to take over Check Point gateways, with some intrusions leading to destructive attacks on VMware ESXi hosts. Check Point has released emergency hotfixes for CVE-2026-123039 and says a couple of dozen customers were affected. The campaign turns the previously identified PHP2Shell risk to firewall and VPN appliances into a route for root access and network intrusion. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware Beginning on October 30, 2026, attackers exploited unpatched vulnerabilities in Check Point Security Gateways, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) and a local privilege escalation vulnerability (CVE-2026-123039). The initial wave targeted Israeli organizations, leading to root access and the deployment of a persistent backdoor named TSGA, which facilitated destructive actions against VMware ESXi hosts. A second wave on November 2 expanded the attack to multiple countries without destructive outcomes. Check Point confirmed that the attackers exploited these vulnerabilities to gain access, escalate privileges, and deploy wiper malware. The campaign is characterized as opportunistic rather than sector-specific, with evidence of active exploitation against a couple of dozen customers. The vulnerabilities were publicly disclosed shortly before the attacks, with patches available but not applied by the affected organizations. 14 sources 73

Extracted Entities

Check Point gateways hit by PHP2Shell attacks that deploy backdoors and ESXi wiper

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Platforms (1)

Tools (1)