Check Point gateways hit by PHP2Shell, with ESXi wiper deployed
Event Brief generated 39 s read
Written by an AI. It was merged from the 2 sources on this page and has not been reviewed by a person.
The short version
- Vulnerable Check Point gateways were targeted through PHP2Shell.
- The attacks deployed a wiper on VMware ESXi hosts.
- Separately, Check Point says a high-severity zero-day gave root access since late October and has issued emergency hotfixes.
What happened
BleepingComputer reports that vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks. The attacks deployed data-wiping malware on VMware ESXi hosts. In a related item, BleepingComputer reports that Check Point released emergency hotfixes for a high-severity flaw that hackers exploited for root access and persistence since late October.
Why it might matter
Organizations running Check Point gateways or ESXi hosts may need to check patch status and backups. A wiper on hypervisors can affect every virtual machine they run.
What we don’t know yet
The feed summaries do not say which Check Point versions are affected, how many devices were hit, or whether the root-access flaw and the PHP2Shell attacks are the same intrusion. The summaries do not name the wiper.
