INCIDENT REPORT · CP-2026-014

Check Point Gateway PHP2Shell Exploitation and ESXi Wiper Attacks

L2 · GUARDEDCONFIRMED

Check Point Research reported that attackers exploited PHP2Shell and a Gaia OS root-escalation flaw on unpatched Check Point gateways, in a first wave from Oct 30, 2026 against Israeli organizations in which some victims' VMware ESXi hosts were hit with a 'destroy_v6' wiper, and a second, non-destructive wave on Nov 2 across multiple countries and sectors. CISA added the Check Point privilege-escalation flaw (CVE-2026-123039) to its Known Exploited Vulnerabilities catalog on Nov 13, 2026.

Incident ID: CP-2026-014
Incident date: 30 OCT 2026
Detection date: Not publicly documented
Affected countries: Israel
Plotted location: Tel Aviv, Israel (Approximate: country of first-wave destructive victims (organizations unnamed))
Threat classification: Level 2 — GUARDED
Classification rationale: Destructive but limited (~two dozen customers), concentrated regionally; CISA KEV listing.
Attack type: Wiper / Destructive Malware
Nature: Malicious activity
Attack vector: Exploitation of PHP2Shell via the Mobile Access portal on unpatched Check Point Security Gateways, plus a Gaia OS DynamicCLI privilege escalation, then SSH pivot to VMware ESXi hosts
Sectors: Technology
Critical infrastructure: No
Organizations affected: Check Point Software Technologies (customers)
Operational consequences: Check Point says exploitation affected 'a couple of dozen' customers, with destructive file wiping on ESXi hosts at some first-wave Israeli victims; victims have not been named. Patches were available before the attacks began.
Estimated financial impact: No reliably documented figure
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Check Point Gateway PHP2Shell Exploitation and ESXi Wiper Attacks

L2 · GUARDEDCONFIRMED

Incident ID

CP-2026-014

Incident date

30 OCT 2026

Detection date

Not publicly documented

Affected countries

Israel

Plotted location

Tel Aviv, Israel (Approximate: country of first-wave destructive victims (organizations unnamed))

Threat classification

Level 2 — GUARDED

Classification rationale

Destructive but limited (~two dozen customers), concentrated regionally; CISA KEV listing.

Attack type

Wiper / Destructive Malware

Nature

Malicious activity

Attack vector

Exploitation of PHP2Shell via the Mobile Access portal on unpatched Check Point Security Gateways, plus a Gaia OS DynamicCLI privilege escalation, then SSH pivot to VMware ESXi hosts

Sectors

Technology

Critical infrastructure

Organizations affected

Check Point Software Technologies (customers)

Operational consequences

Check Point says exploitation affected 'a couple of dozen' customers, with destructive file wiping on ESXi hosts at some first-wave Israeli victims; victims have not been named. Patches were available before the attacks began.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded