# Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

> **Newsylist Open Intelligence Dossier** · First detected: 2026-11-14 14:29 UTC · Category: Business · Sources: 5 · Current Velocity: 3.35

## Intelligence Brief
"Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper" developed substantial multi-source reporting across the Business sector, tracked across 5 distinct newsrooms by Newsylist.


Key reporting was led by Brown & Brown, Rescana, BleepingComputer and The Hacker News. Coverage velocity and cross-outlet momentum were measured using Newsylist open coverage telemetry.


Synthesized from multi-source international reporting and live coverage telemetry under Newsylist open intelligence methodology.

## Verified Facts & Key Claims
### What drove coverage for Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper?
Coverage spiked when 5 independent newsrooms published 6 verified reports during this coverage cycle.

### How did Newsylist track this trend?
Newsylist monitored article arrival rates, source diversity, and cross-outlet validation in real time.

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| Brown & Brown | PHP Vulnerabilities: A Timely Reminder of the Growing Cyber Risk to Businesses | 2026-11-13 16:21 | [Source Link](https://news.google.com/rss/articles/CBMibkFVX3lxTFA1YVhSb1o4U3F3YmswRDZoN0JfZTBwWkRjVUNxbzlXbFNRVE9BRE5XWmo2OGtXZGtlR2tMb1loNU0tWE1WdHVyaXdwYno0REhBM2ZDbTRTbENjVC1GUmZvLWxVQUZaSFE0c0g3RmlR?oc=5) |
| Rescana | Check Point Gaia CVE-2026-123039: Exploited DynamicCLI Root Escalation Added to CISA KEV | 2026-11-13 16:21 | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE9tMnJYMnlvcDhVU2NFcVZUNlNfdWhiQTQxR0dxMlVUUDdQaTZZMEhDMVJNWXN0cjVtV1FSMjFNd2lPcVY2TFJjR0JtY3g0aGpKVzhwaEp0MmNzTG5fMWFfbHgzZmRkMXNLSDRkczFJVEU1UkRkSnIxdW04WjNlVVE?oc=5) |
| BleepingComputer | Check Point warns of zero-day flaw exploited for root access | 2026-11-13 16:21 | [Source Link](https://news.google.com/rss/articles/CBMirwFBVV95cUxNbDdXczZjYnJlT3hQZENPczRkdUszdW1OUjBpbzBXY0MxdldCRlBWdGd6ZU13YnZhSXd2dng2bFdfVlB1VTdEZWVRVEl0S256SEVGZ25fZC1tNEtxTzk3NlEtTlJ1V3k3cDh6T0R6d3FocjZ3aXJBMkRxRF9rOVdDWnVPYjBjUmcza2NpLU0xZUJqSEhXR2VETGRza295NENhSnV6bWN4YWljSElJZG04?oc=5) |
| The Hacker News | Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files | 2026-11-13 16:21 | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE5wY25ETkp0RWNhWVQzZ0xZcXR0RUdSd09HNW52U2JHTmlmTENZcmh0MEdaV0U1RDI4YUk1YTFka196Y3F1NTl5V0NzUFM5NTJjckE1MkpldjEtdjZGRUphbWpDQ1VNVW40azljbTNpWGdpR3hZYUZtMUkzaGdjZw?oc=5) |
| Check Point Research | PHP2Shell Exploitation on Check Point Gateway | 2026-11-13 16:21 | [Source Link](https://news.google.com/rss/articles/CBMiiwFBVV95cUxOY3lGY1RxMkRfeXY3UFdibzRxemdwVGp1aHVSS1ZRV0RvR3QtWDFiRjkwOElreF9qZ09WejdoOWphVEdRYXhraEdESGxLdzVhTmpHem1NZVVOMHZrejMtVWZacmwzUVlaZ2ZyLUhoVnNGQllTVUxqRXpsVF9Cb0F0RlNaV0pySmluSnZn?oc=5) |
| BleepingComputer | Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper | 2026-11-13 16:21 | [Source Link](https://news.google.com/rss/articles/CBMiuAFBVV95cUxQTXd3ZkRGbkx5TGRFckNrTmFCbGJRYlVtOHItRUwxR0h3Y3Bka2p6OFhNSkE5amxYbkVHMFpBQkdVTFBnbFZfbkJERFNjaWp3RER6Z2ZWUldrSGcyWU1XU3F6Y3FKa2ZYeVlyX2dCYWtqdXZ4b29VUi1yTnMxYUNOMTVSVFRxSWNVMy1GWUJDQi1NeTZDQUZIZXhjMl9JNHItMHowekZNZEhTSnFQOEJpcmZvNXhfYl80?oc=5) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-11-14/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*