🔍 Read the full analysis: From PHP2Shell To Wiper: Check Point Gateway Risks Explained on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways from Oct. 30 to Nov. 4, using PHP flaws and a separate root-access vulnerability. In some Israeli incidents, attackers reached VMware ESXi servers and ran a data-wiping program; a later wave showed no evidence of destructive activity. CISA added the root flaw to its exploited-vulnerability catalog and gave U.S. federal agencies until Nov. 16 to act.
Attackers compromised unpatched Check Point Security Gateways between Oct. 30 and Nov. 4, then used a separate flaw to gain root access, according to the company’s investigation. In some incidents targeting Israeli organizations, they moved to VMware ESXi servers and ran a wiper; the U.S. Cybersecurity and Infrastructure Security Agency added the root-access vulnerability, CVE-2026-123039, to its exploited-vulnerability catalog on Nov. 13 and set a Nov. 16 deadline for federal agencies.
Check Point said the observed intrusions began through the gateways’ internet-facing Mobile Access portals. Attackers exploited two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, to run code on affected, unpatched systems. They then used CVE-2026-123039 to escalate from limited access to root privileges, the highest level of control on the appliance.
Check Point’s Nov. 12 report describes a first wave focused on Israeli organizations. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6, which the company says overwrites files with zeros and deletes them. The program left a note named DREAM_ANNEXATION.txt that rejects ransom negotiations. A second wave, on Nov. 2, targeted organizations in multiple countries; Check Point reported no evidence of destructive activity in that wave.
The company said “only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.” It published an advisory and fixes on Nov. 12. Check Point says its PHP2Shell hotfix had been available for the gateways since Oct. 23, before the observed attacks began, but the separate root flaw was disclosed and fixed in the November Jumbo Hotfix.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Could Reach ESXi
The incidents show how an exposed network gateway can become a route to systems beyond the appliance itself. The attackers first used remote code execution through a web-facing portal, then gained root access and, in some cases, reached an ESXi server where they could destroy data. That sequence makes the issue relevant to organizations that use the affected gateways, especially those with internet-facing Mobile Access portals.
The reported impact needs to be kept in proportion: Check Point described a couple of dozen compromised unpatched systems in one region, not a broad count of affected customers or confirmed data losses. Still, the presence of a wiper means some incidents involved destructive activity rather than only attempted access or surveillance. The CISA deadline also gives U.S. federal agencies a defined time to address the root-access flaw.
Products Worth Considering
DJI Osmo 360 Motorcycle Handlebar POV Combo
Kindle Paperwhite 16GB (2024 Model) – Graphite
Anker SOLIX C300 DC Portable Power Station with 60W Solar Panel, 288Wh, 300W
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
PHP2Shell refers to two critical vulnerabilities in PHP. The PHP project released fixes on Oct. 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Each flaw has a CVSS score of 9.2 out of 10. CISA describes them as allowing unauthenticated remote code execution. Check Point said the flaws could be reached through firewall web interfaces on affected gateways.
The initial PHP vulnerabilities and the later root-access flaw are distinct parts of the chain. Check Point rates CVE-2026-123039 7.8 out of 10 and says it requires an attacker to already have local code execution on the appliance. In the reported attacks, PHP2Shell supplied that foothold. Check Point’s November Jumbo Hotfix addresses the root flaw as well as the gateway fixes; the vendor’s listed minimum takes include Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Damage Remain Open
Who carried out the attacks has not been established. Check Point said its evidence does not support a high-confidence assessment of the operation’s nature. The back door is associated with a malware family that ESET has linked to a China-nexus group, but the source report says the destructive, Israel-focused activity does not fit that group’s known interests. That mismatch does not establish a different perpetrator.
The available account also does not provide a complete inventory of affected organizations, the amount of data destroyed, or whether all compromised systems have been found. Check Point reported destructive activity in some first-wave cases and no evidence of it in the later wave; those findings should not be read as proof that every other incident was harmless. The wider number of exposed gateways is also not given.
Patch, Then Check Exposed Gateways
Check Point advises customers to install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and then inspect exposed gateways for the indicators in its advisory. Administrators should verify the installed take against their software version. The source material says R81.10 and older are past end of support, so organizations running those releases should review their upgrade and exposure plans with the vendor.
U.S. federal agencies covered by CISA’s directive must act by Nov. 16. The next developments to watch are further incident findings, any revised vendor guidance, and evidence that clarifies the campaign’s attribution or scope. Until then, the confirmed account is limited to Check Point’s investigated incidents and the activity described by CISA.
Key Questions
Which Check Point systems should administrators prioritize?
Prioritize internet-facing Security Gateways with Mobile Access portals, then install the November Jumbo Hotfix on all Management Servers and Security Gateways as Check Point advises. Confirm the required hotfix take for each software release.
What does PHP2Shell mean in this incident?
PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities. Check Point says attackers used them to run code through affected gateways’ Mobile Access portals.
Was data wiped in every reported attack?
No. Check Point reported a wiper in some incidents in the first wave targeting Israeli organizations. It said it found no evidence of destructive activity in the second wave on Nov. 2.
Is the attacker’s identity known?
No. Check Point said it could not assess the operation’s nature with high confidence. A malware-family association cited in the report is not enough to establish who conducted these attacks.
Source: ThorstenMeyerAI.com
