# Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

> **Open Intelligence Dossier** · First detected: 2026-11-14 13:40 UTC · Category: Business

## Executive Summary
Check Point security gateways face active zero-day exploitation using PHP2Shell flaws to deploy wipers and backdoors.

## Intelligence Brief
Recent reporting establishes that Check Point security gateways are currently experiencing active exploitation through zero-day vulnerabilities. According to coverage from BleepingComputer, The Hacker News, Check Point Research, and Rescana, attackers are leveraging PHP2Shell flaws to gain unauthorized entry. The sequence involves securing root access via targeted exploits, which subsequently allows malicious actors to deploy the TSGA backdoor. Furthermore, coverage highlights the deployment of a VMware ESXi wiper designed to target virtualized files.


The technical scope and threat severity are heavily emphasized across multiple security publications and advisory channels. Outlets such as BleepingComputer and The Hacker News outline the precise operational mechanics of the attack vector against Check Point infrastructure. Concurrently, Check Point Research has published specific advisories detailing the PHP2Shell exploitation occurring on Check Point gateways. Rescana coverage incorporates official vulnerability catalog tracking, noting that the Check Point Gaia CVE-2026-123039 DynamicCLI root escalation flaw has been formally added to the CISA Known Exploited Vulnerabilities catalog.


This unfolding situation provides critical context regarding the persistent targeting of enterprise perimeter devices and gateway appliances by sophisticated threat actors. Because security gateways sit at the absolute boundary of corporate networks, any compromise allowing root escalation directly threatens internal infrastructure and virtual environments. The simultaneous deployment of backdoors like TSGA alongside destructive wipers points toward high-impact disruption campaigns. Organizations relying on these networking products face immediate operational risks as threat groups weaponize these specific administrative interfaces.


Future developments will depend heavily on the availability and deployment of security updates, patches, or mitigations from the vendor. Coverage does not yet specify the full extent of victim organizations or the complete attribution of the threat actors executing these campaigns. Observers will monitor subsequent advisories from CISA, Check Point Research, and independent reporting outlets to track whether additional vulnerability variants emerge or if the exploitation spreads to other gateway components beyond the currently identified PHP2Shell and Gaia instances.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Rescana | Check Point Gaia CVE-2026-123039: Exploited DynamicCLI Root Escalation Added to CISA KEV — Patch Now | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE9tMnJYMnlvcDhVU2NFcVZUNlNfdWhiQTQxR0dxMlVUUDdQaTZZMEhDMVJNWXN0cjVtV1FSMjFNd2lPcVY2TFJjR0JtY3g0aGpKVzhwaEp0MmNzTG5fMWFfbHgzZmRkMXNLSDRkczFJVEU1UkRkSnIxdW04WjNlVVE?oc=5) |
| BleepingComputer | Check Point warns of zero-day flaw exploited for root access | [Source Link](https://news.google.com/rss/articles/CBMirwFBVV95cUxNbDdXczZjYnJlT3hQZENPczRkdUszdW1OUjBpbzBXY0MxdldCRlBWdGd6ZU13YnZhSXd2dng2bFdfVlB1VTdEZWVRVEl0S256SEVGZ25fZC1tNEtxTzk3NlEtTlJ1V3k3cDh6T0R6d3FocjZ3aXJBMkRxRF9rOVdDWnVPYjBjUmcza2NpLU0xZUJqSEhXR2VETGRza295NENhSnV6bWN4YWljSElJZG04?oc=5) |
| The Hacker News | Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE5wY25ETkp0RWNhWVQzZ0xZcXR0RUdSd09HNW52U2JHTmlmTENZcmh0MEdaV0U1RDI4YUk1YTFka196Y3F1NTl5V0NzUFM5NTJjckE1MkpldjEtdjZGRUphbWpDQ1VNVW40azljbTNpWGdpR3hZYUZtMUkzaGdjZw?oc=5) |
| Check Point Research | PHP2Shell Exploitation on Check Point Gateway | [Source Link](https://news.google.com/rss/articles/CBMiiwFBVV95cUxOY3lGY1RxMkRfeXY3UFdibzRxemdwVGp1aHVSS1ZRV0RvR3QtWDFiRjkwOElreF9qZ09WejdoOWphVEdRYXhraEdESGxLdzVhTmpHem1NZVVOMHZrejMtVWZacmwzUVlaZ2ZyLUhoVnNGQllTVUxqRXpsVF9Cb0F0RlNaV0pySmluSnZn?oc=5) |
| BleepingComputer | Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper | [Source Link](https://news.google.com/rss/articles/CBMiuAFBVV95cUxQTXd3ZkRGbkx5TGRFckNrTmFCbGJRYlVtOHItRUwxR0h3Y3Bka2p6OFhNSkE5amxYbkVHMFpBQkdVTFBnbFZfbkJERFNjaWp3RER6Z2ZWUldrSGcyWU1XU3F6Y3FKa2ZYeVlyX2dCYWtqdXZ4b29VUi1yTnMxYUNOMTVSVFRxSWNVMy1GWUJDQi1NeTZDQUZIZXhjMl9JNHItMHowekZNZEhTSnFQOEJpcmZvNXhfYl80?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-11-14/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper*