Hackers Exploit Check Point Flaws to Wipe ESXi

Unknown actors exploited PHP2Shell flaws in Check Point gateways starting October 30, 2026, to deploy the TSGA backdoor. A follow-up wave on November 2, 2026, targeted global organizations. Attackers used CVE-2026-123039 for privilege escalation and deployed destroyv6 wiper malware to delete files, leaving DREAMANNEXATION.txt notes. While linked to Armory Castle, evidence remains inconclusive regarding the specific threat actor.