Check Point Gateway Intrusion Leads to ESXi Data Wiper

Check Point gateways became the starting point for an intrusion that reached a VMware ESXi server and deployed a data wiper, according to research published November 12. The case turns a familiar security assumption inside out: the equipment protecting a network can itself become the route into it.

The company's advisory describes a chained attack rather than one all-powerful bug. PHP2Shell opened the web-facing entry point; a separate privilege-escalation flaw then gave the intruder administrator-level control. Check Point says fixes had been available since October 23, a week before the observed attacks. The accompanying note demanded no ransom.

PHP supplies the software behind many web interfaces. The PHP project's October 21 advisory explains two memory-handling failures that can permit remote code execution without a login. One involves interrupted processing when memory runs short. The other can leave obsolete internal state available after its underlying memory has been released. Think of a service desk treating a canceled form as valid paperwork: a failure in handling incoming material, not simply an incorrectly rendered page.

The research distinguishes two waves. Destructive activity affected some Israeli organizations beginning October 30. A November 2 wave extended across countries and sectors without observed destruction. In the examined intrusion, the attacker moved from the gateway to ESXi and ran the destroy_v6 wiping tool. Researchers did not confidently attribute the operation.

ESXi matters because it sits underneath virtual machines. VMware describes a hypervisor as the layer that lets multiple virtual computers, each with its own operating system and applications, share one physical host. That arrangement saves space, power and maintenance. A useful analogy is an office building: individual rooms are separate, but they still depend on the building's underlying facilities. Reaching the host is therefore a different problem from compromising one employee's application.

The news is the documented connection between an exposed gateway, deeper network access and destructive action, rather than the mere existence of another patch. Check Point recommends its November Jumbo Hotfix, prioritizing internet-facing remote-access gateways, plus investigation of suspicious processes and gaps in firewall logs. The company cautions that failing to find a listed indicator does not establish that a system is clean.

For an organization, prevention and incident response answer different questions. Changing the lock addresses the entrance; it does not establish whether someone has already moved inside. This case makes that distinction concrete for the infrastructure people normally trust to stand guard.

Original sources published: Check Point, November 12, 2026.