Attackers Exploit Check Point Vulnerabilities to Deploy Wiper Malware

• •Attackers exploited PHP2Shell and CVE-2026-123039 to gain root access.
• •Destructive wiper malware was deployed against VMware ESXi hosts in the first wave.
• •The campaign targeted both Israeli organizations and entities worldwide, indicating opportunistic scanning.

Beginning on October 30, 2026, attackers exploited unpatched vulnerabilities in Check Point Security Gateways, specifically the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) and a local privilege escalation vulnerability (CVE-2026-123039). The initial wave targeted Israeli organizations, leading to root access and the deployment of a persistent backdoor named TSGA, which facilitated destructive actions against VMware ESXi hosts. A second wave on November 2 expanded the attack to multiple countries without destructive outcomes. Check Point confirmed that the attackers exploited these vulnerabilities to gain access, escalate privileges, and deploy wiper malware. The campaign is characterized as opportunistic rather than sector-specific, with evidence of active exploitation against a couple of dozen customers. The vulnerabilities were publicly disclosed shortly before the attacks, with patches available but not applied by the affected organizations.