PHP2Shell attacks hit Check Point gateways and wipe ESXi data

PHP2Shell attacks that began on October 30 breached Check Point gateways at Israeli organizations and wiped data from VMware ESXi hosts inside their networks. A second wave on November 2 reached companies in several countries and industries, although investigators found no evidence of data wiping in those cases.

Check Point traced the Israeli intrusions from the exposed gateways to the affected servers. Its researchers concluded that one attacker handled both the initial break-ins and the destructive activity. In the second wave, investigators identified the gateway breaches, but what the attacker did afterward remains unclear.

Attackers leave a political note on VMware hosts

In the Israeli cases, investigators found a program called destroy_v6 on affected VMware ESXi hosts. The malware could overwrite data before deleting it, making recovery more difficult. The attacker also left a note containing political messages and a reference to Dream Security Ltd. It explicitly ruled out ransom negotiations, pointing to disruption as the likely aim.

Who carried out the attacks remains an open question. Researchers found similarities between a backdoor on the gateways and PhiliKit, a malware framework previously seen in breaches of Ivanti appliances. Earlier research had linked PhiliKit to the Chinese threat group UNC5221. However, neither the software similarities nor the political note gave investigators enough evidence to identify the attacker.

Emergency PHP fixes preceded the gateway breaches

The PHP2Shell attacks take their name from two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both allow an attacker to run code remotely without signing in. Researchers recorded the first exploitation attempts on October 17, four days before the PHP project released emergency fixes. On October 26, the US Cybersecurity and Infrastructure Security Agency added both flaws to its catalog of known exploited vulnerabilities.

Check Point’s November Jumbo Hotfix addresses both PHP flaws and a separate privilege escalation vulnerability, CVE-2026-123039, that investigators identified in the gateway breaches. The company recommends installing the update on all Management Servers and Security Gateways, starting with gateways whose Mobile Access portals face the internet.

For administrators reviewing previously exposed gateways, Check Point highlighted unexpected processes and unexplained gaps in firewall logs. It also flagged unauthorized SSH connections from a gateway to an internal ESXi host. Those connections can help investigators determine whether an intrusion reached the systems that run the organization’s virtual machines.