Check Point Traces a Gateway Intrusion to an ESXi Wiper
Check Point has disclosed attacks in which an unpatched Mobile Access portal became a route into a customer network. In one investigation, the attacker exploited PHP2Shell on the gateway, gained root through a separate Gaia flaw and later used SSH to reach a VMware ESXi host, where a wiper ran. An exposed gateway that was vulnerable during the campaign warrants an incident review even after it is patched. Check Point Research investigation
Two waves had different outcomes
Check Point traced the first wave to 30 October and reported destructive activity against some Israeli targets. A second wave on 2 November reached more countries. Researchers found no evidence of destructive activity in that later wave. The investigated chain used the PHP flaws for initial access and a local weakness in Gaia’s DynamicCLI service to gain root on the gateway. CVE-2026-109618 · CVE-2026-109619 · CVE-2026-123039
Patch the gateway and look beyond it
Check Point recommends installing its November Jumbo Hotfix on Management Servers and Security Gateways, starting with internet-facing Mobile Access deployments. Verify the hotfix take for each branch. The earlier PHP hotfix addressed initial access through PHP2Shell. Confirm that the later Gaia fix is also present on affected systems. Check Point security advisory
For a gateway that was exposed while vulnerable, preserve logs and check for the vendor’s indicators, including unexpected webshells and unexplained firewall log gaps. Review management connections from the gateway to virtualisation hosts and investigate unusual SSH activity. Check Point’s account shows why recovery needs to cover both the perimeter device and the systems it could reach. Indicators and technical analysis
