Attackers exploit PHP2Shell-related vulnerabilities in some unpatched Check Point Security Gateway appliances to gain initial access and then deploy destructive malware targeting VMware ESXi hosts. Across the reports, the outcome includes wiping or deleting ESXi files, indicating attempts to disrupt virtualized infrastructure.
The coverage also points to additional steps after the initial compromise. One outlet describes attackers using a local privilege escalation weakness in Check Point’s Gaia OS to move to higher privileges, enabling deployment of further payloads. Another report adds detail that a backdoor was installed alongside the destructive activity.
Overall, the outlets agree on the main chain: PHP2Shell flaws in Check Point gateways are leveraged for intrusion, followed by subsequent actions that affect VMware ESXi systems. Differences are mainly in emphasis—some focus on the wiper effect, while others foreground the backdoor and the privilege-escalation component, along with the reported targeting timeline and geography mentioned by one source.
