Hackers Wiped VMware Servers Through Check Point Gateways—Here's How

Michael Miller · 2026-11-13

You know that feeling when you patch something and assume you're safe? That's exactly the assumption attackers just shattered. Vulnerable Check Point Security Gateway instances got hit in what researchers are calling PHP2Shell attacks—and the payload wasn't a data grab. It was a wiper designed to erase VMware ESXi hosts. Not steal. Not ransom. Just wipe. If you run ESXi in your stack, that distinction matters more than you think. ### What Actually Happened Check Point Security Gateways sit at the edge of a lot of networks. They're the front door. In this campaign, attackers found a way in through a flaw that let them execute PHP code—hence the PHP2Shell name—and from there they pivoted toward the virtualization layer. The end goal was VMware ESXi, the hypervisor a lot of businesses rely on to run their entire server fleet. Once inside, the attackers pushed data-wiping malware. That's a destructive move, not a financial one. It's the kind of attack designed to cause maximum operational pain. ### Why ESXi Keeps Showing Up in These Stories Here's the uncomfortable truth: ESXi is a favorite target for a reason. - It often runs with minimal monitoring compared to production workloads - Hypervisor access means access to *everything* hosted on it - Many teams treat it as infrastructure and forget it's also an attack surface - Recovery from a wiper is slow, expensive, and sometimes impossible without backups When someone wipes an ESXi host, they're not deleting one server. They're deleting dozens of virtual machines in a single stroke. That's the leverage attackers are looking for. > "The gateway is the door. The hypervisor is the vault. Attackers are learning to walk from one to the other in a single visit." ### What This Means If You Manage Infrastructure First, treat your edge devices like the critical systems they are. A Check Point gateway isn't just a security appliance—it's a potential entry point if it's running unpatched software. A few practical takeaways: - Verify your gateway firmware is current, and don't wait for a scheduled maintenance window - Isolate ESXi management interfaces from general network traffic - Keep offline or immutable backups of your VMs—wipers don't care about your retention policy - Monitor lateral movement between edge devices and virtualization hosts - Test your restore process before you need it, not during an incident ### The Bigger Picture This campaign is a reminder that security tools are software too. They have vulnerabilities, they need patching, and they can be turned into a stepping stone if you're not watching. The attackers here weren't chasing a quick payday. They wanted to break things. That changes the calculus—you can't negotiate with destructive malware, and you can't pay your way out of a wiper. Your only real defense is preparation. So take a minute today. Check your gateway version. Look at your ESXi exposure. And ask yourself honestly: if someone got past the front door, how far could they walk before you noticed? That question is worth more than any patch.