Check Point says PHP2Shell gateway breaches led to VMware ESXi wiper attacks

According to Check Point, attackers exploited PHP2Shell and a second flaw to gain root access, then moved from gateways to VMware ESXi hosts and deployed a data wiper. The company recommends installing its November Jumbo Hotfix and checking previously exposed gateways for compromise. It could not confidently attribute the operation, and no destructive activity was observed in a second, international wave.