🔍 Read the full analysis: From PHP2Shell To Wiper: How Attackers Hit Check Point Gateways, And What To Patch Now on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers used PHP vulnerabilities to break into unpatched Security Gateways from October 30 to November 4, then exploited a separate flaw to gain root access. In some incidents targeting Israeli organizations, they moved to VMware ESXi servers and ran a wiper; the company says it found no destructive activity in a later wave. Check Point released fixes on November 12, and CISA added the root-access flaw to its exploited-vulnerability catalog on November 13.
Attackers broke into unpatched Check Point Security Gateways between October 30 and November 4, used a separate vulnerability to gain root access and installed a back door, according to the company’s November 12 investigation. In some incidents involving Israeli organizations, the attackers moved to VMware ESXi servers and ran a data-wiping program; Check Point said it found no evidence of destructive activity in a second wave targeting organizations in multiple countries.
Check Point says the initial access came through internet-facing Mobile Access portals, using two critical PHP vulnerabilities known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. The PHP flaws allowed unauthenticated remote code execution, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Attackers then exploited CVE-2026-123039, a separate flaw in the Gaia operating system, to elevate their access to root, the appliance’s most privileged account.
The company’s investigation describes a back door and web shells placed in the Mobile Access portal’s files. In some of the first-wave incidents, attackers reached a VMware ESXi host and ran a wiper called destroy_v6, which Check Point says overwrites files with zeros before deleting them by default. The associated note, DREAM_ANNEXATION.txt, rejects ransom negotiations. Check Point says the later wave, beginning November 2 and affecting organizations across multiple countries, showed no evidence of destructive activity.
Check Point said “only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.” It advises customers to install its November Jumbo Hotfix on management servers and gateways, prioritizing internet-facing Mobile Access portals, and to inspect exposed systems for indicators of compromise. The vendor lists minimum hotfix takes including Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Breaches Reached Virtual Servers
The incidents show how a flaw in an exposed network appliance can become a route to systems behind it. Here, the reported chain began with remote code execution through a gateway portal, escalated to root-level control and, in some cases, reached VMware infrastructure where data was targeted for destruction. That makes the incident relevant beyond organizations that use Mobile Access: it highlights the potential consequences when an internet-facing appliance is left unpatched.
The reported wiper activity also differs from a typical extortion incident. Check Point says the note left by destroy_v6 explicitly rejected ransom negotiations, while the company has not attributed the operation with confidence. CISA’s November 13 catalog entry adds urgency for U.S. federal agencies, which were directed to address CVE-2026-123039 by November 16. Other organizations should follow their own security and regulatory requirements while applying the vendor’s fix.
Products Worth Considering
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
DJI Mini 3 Drone with DJI RC and 3‑Axis Mechanical Gimbal
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
The PHP vulnerabilities and the root-access vulnerability played different roles. The PHP flaws, fixed by the PHP project on October 21, provided a way to run code through affected web interfaces. Check Point says a hotfix for PHP2Shell on its gateways was available on October 23, before the observed attacks began on October 30. The appliance-specific root flaw was disclosed, and its fix included in the November Jumbo Hotfix, on November 12.
CISA added the PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, then added CVE-2026-123039 on November 13. Check Point rates the root flaw 7.8 out of 10, high, and says an attacker must already have local code execution on the appliance to exploit it. In the reported chain, PHP2Shell supplied that initial foothold.
Check Point’s advisory says R81.10 and older versions are past end of support. The company recommends applying the relevant November Jumbo Hotfix to supported management servers and gateways, then checking all exposed systems for the signs of compromise it identifies. The supplied account does not specify every affected appliance configuration, so administrators should consult Check Point’s advisory for product-specific guidance.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Full Scope Remain Open
Check Point has not attributed the operation with confidence. It says a back door found in the incidents belongs to a malware family that ESET has linked to a China-nexus group, but the destructive activity focused on Israeli organizations does not fit that group’s known interests. That connection is not proof that the group carried out these attacks.
The company’s estimate of a couple of dozen compromised systems applies to the incidents it observed. The available material does not establish whether additional victims were missed, whether all compromises were detected or whether the attackers accessed or removed data beyond the systems where wiper activity was found. It also does not provide a confirmed account of the attackers’ identity or motive. Check Point’s report describes separate waves, but the relationship between them remains unclear.
Patch, Inspect, and Meet CISA’s Deadline
Organizations using Check Point Security Gateways should install the November Jumbo Hotfix on management servers and gateways, starting with internet-facing Mobile Access portals, and use Check Point’s advisory to select the correct software take. They should also review exposed systems for the indicators of compromise in the company’s investigation. CISA’s directive gives U.S. federal agencies until November 16 to address CVE-2026-123039.
Administrators running R81.10 or older should account for the fact that those releases are past end of support and seek the vendor’s current guidance. The next reported milestones are remediation and further investigation; the source material gives no date for an additional Check Point update. Attribution, the full victim count and whether the two attack waves had a common operator remain unresolved.
Key Questions
What happened to the Check Point gateways?
Check Point says attackers used two PHP vulnerabilities to access unpatched Security Gateways through Mobile Access portals, then exploited a separate flaw to gain root access and install a back door.
Did the attacks destroy data?
In some first-wave incidents involving Israeli organizations, Check Point says attackers reached VMware ESXi servers and ran the destroy_v6 wiper. The company reported no evidence of destructive activity in the second wave.
Which vulnerability did CISA add on November 13?
CISA added CVE-2026-123039, the Check Point Gaia flaw used to elevate access to root, to its Known Exploited Vulnerabilities catalog. U.S. federal agencies were given until November 16 to address it.
What should Check Point customers do?
Install the November Jumbo Hotfix on management servers and gateways, prioritizing internet-facing Mobile Access portals, and check exposed systems for the indicators listed in Check Point’s advisory. Customers should use the advisory to identify the correct hotfix take for their version.
Who was behind the attacks?
That has not been established. Check Point said the evidence did not support a high-confidence assessment of the operation’s nature. A malware-family link reported by ESET is not, on its own, confirmation of who conducted these attacks.
Source: ThorstenMeyerAI.com
