# Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Gain Root Access and Wipe VMware Hosts

*Friday, November 13, 2026 at 10:06 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-13T10:06:34.495Z (50m ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: https://t.me/KurdishFrontNews/34017 | https://t.me/BossBotOfficial/21690 | https://t.me/BossBotOfficial/21689 | https://t.me/operativnoZSU/226046 | https://t.me/operativnoZSU/226045
**Permalink**: https://hamerintel.com/data/articles/23350.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers are abusing unpatched PHP2Shell vulnerabilities in Check Point gateways worldwide to obtain root access, install hidden backdoors and delete files on VMware ESXi servers, in a campaign that shows how a single flaw in an edge device can cascade into serious data loss.

Hackers are turning Check Point security gateways into entry points, exploiting PHP2Shell vulnerabilities to take full control of devices and move deeper into corporate networks.

According to reporting from security sources, attackers are targeting organizations that have not patched known PHP2Shell flaws in their Check Point gateways. Successful exploitation lets them run code as root, the highest level of system privilege.

Once inside, the intruders deploy backdoors and other implants designed to survive restarts and evade basic monitoring. They then pivot toward critical systems, including VMware ESXi hosts. In some documented incidents, they have wiped files on ESXi servers, which can knock out many virtual machines and the business applications running on them.

Because gateways sit at the network edge, a compromise at this layer gives attackers an advantageous position. With root access, they can disable logging, create hidden accounts and route traffic in ways that are difficult for defenders to spot quickly.

The campaign has reached organizations in multiple countries, though the reporting so far doesn’t specify which sectors are most heavily affected. When ESXi hosts are damaged, the impact can range from internal tools going offline to outages in public‑facing websites and services.

The incidents highlight a recurring weakness: security appliances are sometimes left unpatched or monitored less closely than servers and endpoints inside the network. Vulnerabilities in these devices can be especially dangerous because of the level of trust and access they have by design.

Signals to watch now include how quickly administrators apply Check Point’s patches and mitigations, whether incident responders report more cases of ESXi damage linked back to these gateway flaws, and any new guidance from Check Point or national cyber agencies on detecting and removing PHP2Shell‑related backdoors.