Check Point Gateway Breaches Expose ESXi to Wipers

A Single Portal Breach Reaches the Hypervisor

Unauthenticated access via the Mobile Access portal on Check Point gateways allowed attackers to execute arbitrary code through PHP2Shell and immediately pivot to VMware ESXi hosts. The compromise bypassed network segmentation, enabling direct deployment of a custom wiper that overwrote virtual machine files and configuration stores on production hypervisors.

Once inside the gateway, the attackers leveraged the shell to enumerate connected management interfaces and identify ESXi servers reachable over the internal network. From there they staged the wiper binary, which targeted .vmdk and .vmx files along with the VMFS metadata, rendering dozens of critical virtual machines inoperable within minutes of execution.

The attack chain required no valid credentials on the hypervisor layer itself. Instead, the initial portal foothold supplied the necessary lateral movement capability, exposing how a single exposed service can collapse the boundary between perimeter defenses and core virtualization infrastructure.

Organizations running both Check Point gateways and VMware ESXi must treat any Mobile Access portal exposure as a direct hypervisor risk. Rapid isolation of management traffic and strict validation of portal-exposed services are now essential to prevent similar gateway-to-hypervisor wipe campaigns.

PHP2Shell Exploitation Timeline and Vectors

The two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enabled remote code execution through PHP2Shell mechanisms in Check Point gateways. Attackers began exploiting these flaws on October 17, four days before emergency patches were issued on October 21. Initial access relied on unauthenticated HTTP requests that triggered shell command execution without requiring prior authentication on affected appliances.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog shortly after public disclosure, underscoring the rapid weaponization observed in the wild. The timeline shows coordinated campaigns that first scanned for exposed management interfaces, then deployed the PHP2Shell payloads to establish persistence before moving laterally within virtualized environments.

Exploitation chains frequently combined the PHP flaws with the Fragnesia Linux kernel vulnerability to escalate privileges and obtain root access on the underlying host. This sequence allowed adversaries to bypass container isolation and directly target VMware ESXi hypervisors for subsequent wiper deployment. Organizations monitoring gateway logs during the October 17–21 window reported repeated attempts to invoke the vulnerable PHP endpoints.

Analysis of the attack vectors reveals consistent use of crafted POST requests that abused deserialization routines in both CVEs, followed by kernel-level exploits once shell access was achieved. The integration of these techniques produced a reliable path from external exposure to full hypervisor compromise.

Lateral Movement from Perimeter to Virtualized Hosts

Compromise of the Check Point gateway via the PHP2Shell backdoor gave attackers an authenticated shell on the perimeter device. From this position they harvested configuration files, firewall rules, and any cached credentials, then used the gateway’s internal routing tables to identify adjacent management subnets.

With those details the operators pivoted to vCenter and ESXi hosts that were reachable over the same segments. In several cases they reused domain accounts previously used for gateway administration; in others they exploited exposed vSphere Web Client interfaces that lacked multi-factor authentication.

Once on the hypervisors, the attackers uploaded a lightweight wiper binary through the datastore browser or via SCP. The malware overwrote virtual-machine disk files and deleted snapshots before rebooting the hosts. Several wiped systems displayed custom political messages in the ESXi console and in ransom notes left on remaining VMs, indicating the operation carried both disruptive and ideological objectives.

The entire chain—from gateway shell to hypervisor wiper—completed in under four hours in the fastest observed incidents, highlighting how a single perimeter breach can grant direct control over virtualized infrastructure.

Cascading Risks in Mission-Critical Infrastructure

The campaign opened on October 30 with targeted intrusions against Israeli organizations, where attackers leveraged the PHP2Shell vulnerability on exposed Check Point gateways to gain initial footholds. Within days the operation expanded, and on November 2 a second wave struck entities across multiple countries and sectors, including finance, logistics, and government services. These sequential strikes revealed how a single perimeter compromise can rapidly propagate when gateways sit adjacent to load balancers and hypervisors.

In affected environments the compromised Check Point appliances served as the sole barrier between internet-facing services and backend virtualization clusters. Once the wiper payload reached the VMware ESXi hosts, attackers could enumerate datastores, terminate critical virtual machines, and overwrite configuration files without triggering separate network controls. The proximity of the gateway to these high-value assets eliminated the layered segmentation that normally limits lateral movement.

Mission-critical operators often place security gateways near load balancers to streamline traffic inspection, yet this topology creates a direct path from external exploitation to hypervisor destruction. The November 2 incidents demonstrated that a single successful gateway breach can cascade into simultaneous loss of compute, storage, and orchestration layers. Organizations managing information technology infrastructures must therefore re-evaluate placement decisions that collapse defensive boundaries around essential virtualization resources.

Layer 7 Controls and Continuous Posture Assessment

Application-layer inspection on perimeter gateways can intercept PHP2Shell-style uploads before they establish persistence. By enforcing strict content-type validation, request-method whitelisting, and payload-size thresholds at Layer 7, organizations block the initial web-shell delivery that later stages used to reach VMware ESXi hosts.

Automated compliance scanning complements this by continuously validating gateway rule bases against hardening benchmarks. Scans that flag overly permissive management interfaces or exposed PHP handlers surface misconfigurations within hours rather than weeks, closing the window that allowed attackers to pivot from the Check Point appliance to hypervisor storage.

When posture data feeds directly into dynamic access policies, any drift—such as an enabled legacy management port—triggers immediate traffic blocks. This prevents the lateral movement observed in the ESXi wiper campaign, where a single compromised gateway became the sole path to virtual-machine datastores.

Together, these controls shift detection left: unauthorized administrative paths are denied at the application edge long before credentials or scripts reach the virtualization layer.

Immediate Steps to Reduce Exposure

Organizations facing Check Point gateway exposure must prioritize emergency patching of PHP environments to close the PHP2Shell vector that enables initial foothold and subsequent ESXi wiper deployment. Security teams should verify all publicly reachable gateways against the latest vendor advisories and apply cumulative updates without delay, as unpatched instances remain the primary entry point observed in recent campaigns.

Mobile Access policies require immediate tightening. Disable unnecessary portal features, enforce certificate-based authentication, and restrict client connections to approved IP ranges. These controls limit lateral movement opportunities that attackers exploit after compromising the gateway.

Continuous Validation and Segmentation

Deploy LSE CenTest for ongoing compliance scans that detect misconfigurations in real time and flag deviations from hardened baselines. Pair this with the LSE Layer 7 load balancer to enforce granular segmentation between management interfaces, guest networks, and critical virtualization hosts, reducing the blast radius of any successful compromise.

Security leaders should evaluate LSE CenTest immediately to operationalize these controls across their infrastructure.

How LSE CenTest security/compliance platform and the LSE Layer 7 load balancer Helps

Teams navigating the issues above don't have to solve them from scratch. LSE CenTest security/compliance platform and the LSE Layer 7 load balancer was built for exactly this kind of operational challenge, giving teams a practical path forward without reinventing the wheel in-house.