🔍 Read the full analysis: Check Point Gateways Under Attack: The PHP2Shell-to-Wiper Sequence on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers compromised a couple dozen unpatched Security Gateways between October 30 and November 4, using PHP2Shell flaws for initial access and a separate vulnerability to gain root. In some Israeli-targeted incidents, the intruders moved to VMware ESXi servers and ran a destructive wiper; a second wave showed no evidence of destructive activity. Check Point released a hotfix on November 12, and CISA added the root-access flaw to its exploited-vulnerability catalog on November 13.
Attackers compromised a couple of dozen unpatched Check Point Security Gateways between October 30 and November 4, using PHP flaws to enter through Mobile Access portals and a separate vulnerability to gain root access, Check Point said. In some incidents, the attackers then reached VMware ESXi servers and ran a data-wiping program; the company has not attributed the operation with high confidence.
Check Point’s November 12 investigation describes an intrusion chain that began with PHP2Shell, a name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Attackers used them against unpatched gateways’ Mobile Access portals to run code under the portal’s service account. They then exploited CVE-2026-123039 to escalate privileges to root on the appliance, according to the company.
Check Point says the first observed wave targeted Israeli organizations. In some cases, the attackers moved from a gateway to a VMware ESXi host and ran a wiper named destroy_v6, which by default overwrites files with zeros before deleting them. The note left by the program, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations, the company said. A second wave, on November 2, targeted organizations in multiple countries, with Check Point reporting no evidence of destructive activity in those incidents.
The vendor said it had a PHP2Shell hotfix for its gateways available on October 23, before the observed attacks began. The fix for the separate root-access flaw was included in its November Jumbo Hotfix, disclosed November 12. Check Point advises customers to install that hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and to review exposed devices for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Intrusions Reached ESXi
The incidents show how a weakness in an internet-facing gateway can become a route to systems beyond the appliance. In the reported destructive cases, attackers used two flaws in sequence: PHP2Shell provided code execution, while CVE-2026-123039 elevated access to root. From there, some intruders reached virtualization infrastructure, where wiping files could disrupt more than the gateway itself.
The reported scale is limited to the incidents Check Point observed: the company said only a couple of dozen unpatched systems in one region were compromised. That count does not establish the total number of attempted intrusions or rule out other affected systems. The distinction between the first destructive wave and the later wave with no observed destructive activity also matters; the source does not say every compromised gateway was followed by a wiper.
For organizations using these gateways, the immediate concern is both exposure and possible persistence. Check Point says attackers installed web shells and a back door designed to survive a restart. Installing a fix addresses the vulnerability, but customers also need to check exposed systems for evidence that an intruder already gained access.
Products Worth Considering
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Chain
The PHP vulnerabilities affect PHP components embedded in other products, including network appliances. The PHP project released fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on October 26 and described them as allowing unauthenticated remote code execution. Check Point’s advisory said the flaws could permit remote code execution through firewall web interfaces.
On November 12, Check Point disclosed CVE-2026-123039, a separate weakness in the Gaia operating system used by its appliances. The company rated it 7.8 out of 10, or high, and said exploitation requires code execution on the appliance first. CISA added this root-access flaw to its exploited-vulnerability catalog on November 13 and set a November 16 deadline for U.S. federal agencies to act.
Check Point lists minimum hotfix takes for supported versions: Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. The company says R81.10 and older versions are past end of support. CISA has also warned that PHP may be embedded in other software and may not be readily visible to users; unsupported PHP 8.1 or earlier systems should be taken offline until they can be updated, according to the agency.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Exposure Remain Open
Who carried out the operation remains uncertain. Check Point says it cannot assess the operation’s nature with high confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity and Israel-focused first wave do not fit that group’s known interests. That mismatch is not proof of who was responsible.
The investigation describes a limited number of observed compromised systems, but does not establish how many organizations were targeted, how many attempts failed, or whether other victims have not yet been identified. It also does not specify the extent of data loss on affected ESXi hosts or whether every compromised gateway received the same back door. Check Point’s report found no evidence of destructive activity in the November 2 wave, but that finding is limited to the incidents it investigated.
Patch, Then Check for Intrusion
Organizations using Check Point gateways should apply the November Jumbo Hotfix to supported Management Servers and Security Gateways, beginning with internet-facing Mobile Access portals. They should use Check Point’s version-specific minimum hotfix takes and review all exposed appliances for the indicators listed in the vendor’s advisory. Updating alone may not resolve an existing compromise, given the reported web shells and restart-persistent back door.
U.S. federal agencies face a separate deadline: CISA’s catalog entry gives them until November 16 to address CVE-2026-123039. The next public developments to watch are additional findings from Check Point or other investigators, any further victim disclosures, and updates to CISA’s guidance. The available source material does not identify a confirmed perpetrator or describe a completed remediation tally.
Key Questions
Which Check Point products and vulnerabilities are involved?
The report concerns Check Point Security Gateways with Mobile Access portals. Attackers used PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 for initial code execution, then CVE-2026-123039 to gain root access.
Did every affected organization experience data wiping?
No. Check Point reported wiper activity in some incidents in the first wave targeting Israeli organizations. It said the November 2 wave across multiple countries showed no evidence of destructive activity.
What should Check Point customers do?
Install the November Jumbo Hotfix on supported Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Then check exposed systems for the compromise indicators in Check Point’s advisory; versions R81.10 and older are past end of support, according to the company.
Has the attacker been identified?
No. Check Point says it cannot assess the operation’s nature with high confidence. ESET has linked the back-door family to a China-nexus group, but the available evidence does not establish that group as responsible for these attacks.
Source: ThorstenMeyerAI.com
