Summary

Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]

For more information, read the full story at the original source: BleepingComputer ↗

Vulnerabilities in this story

• CVE-2026-109618 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-109619 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-123039 KEV · fix by 2026-11-16 checkpoint Quantum Security Gateway, checkpoint Quantum Security Management EPSS 1.2% 7.8High

Also reported by

• Network World: The firewall becomes the foothold: Attackers turn Check Point gateways against customers ↗
• The Hacker News: Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files ↗
• Security Affairs: Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell ↗
• SecurityWeek: PHP2Shell Exploited in Destructive Check Point Gateway Attacks ↗