🔍 Read the full analysis: Patch Check Point Gateways With This PHP2Shell-to-Wiper Context on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways from Oct. 30 to Nov. 4, using PHP2Shell flaws and a separate vulnerability to gain root access. Some incidents included a wiper attack on VMware ESXi servers; the vendor says a second wave showed no evidence of destructive activity. CISA added the root-access flaw to its exploited-vulnerabilities catalog and ordered US federal agencies to address it by Nov. 16.
Check Point says attackers compromised unpatched Security Gateways between Oct. 30 and Nov. 4, exploiting PHP flaws to enter through Mobile Access portals and then using a separate vulnerability to gain root access. In some incidents, the intruders moved to VMware ESXi servers and ran a wiper that destroys data; the company says a separate wave showed no evidence of destructive activity. The disclosures matter because the root-access flaw was under active exploitation, prompting CISA to set a Nov. 16 deadline for US federal agencies to address it.
Check Point published its investigation, an advisory and fixes on Nov. 12. The company says attackers first used PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 against unpatched gateways’ Mobile Access portals. Those flaws enabled remote code execution, initially under the portal service account. The attackers then used CVE-2026-123039 to obtain root privileges on the appliance and establish a back door.
Check Point reported that the first wave targeted organizations in Israel. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper named destroy_v6, which overwrites files with zeros before deleting them. The accompanying note, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to the vendor. A second wave, on Nov. 2, affected organizations in multiple countries; Check Point said it found no evidence of destructive activity in those incidents.
The vendor said only “a couple of dozen unpatched systems, in a single region” were compromised in the incidents it observed. It says a PHP2Shell hotfix for its gateways was available on Oct. 23, before the attacks began. The separate root-access flaw was disclosed, with its fix included in the November Jumbo Hotfix, on Nov. 12. Check Point recommends installing that hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Root Access Matters
A compromised security gateway can provide an attacker a foothold at the edge of an organization’s network. In this case, the reported chain moved from remote code execution through a public-facing portal to root-level control of the appliance. Check Point’s account also shows the potential consequences can extend beyond the gateway: some attackers reached VMware ESXi hosts and launched software designed to erase data.
The reported scope is limited to the incidents Check Point investigated, and the company described only a couple of dozen compromised unpatched systems in one region. That figure does not establish the total number of affected or exposed devices. Still, CISA’s catalog listing and federal deadline make the root-access flaw a time-sensitive issue for US agencies, while other organizations should use the vendor’s guidance to prioritize patching and investigation.
The incident also illustrates a patching gap in products that bundle third-party components. PHP released fixes for the underlying PHP flaws, but appliance customers depend on device manufacturers to provide and distribute fixes within their products. Applying PHP updates alone may not address a vulnerability in an appliance’s integrated software.
Popular right now
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
Vitamix 5200 Blender with 64 oz Container, Black
TCL 55-Inch T7 Series 4K QLED Smart Google TV (55T7)
As an affiliate, we earn on qualifying purchases.
How the Exploit Chain Developed
The two PHP vulnerabilities, referred to as PHP2Shell, affect PHP, a programming language used in websites and other software. The PHP project fixed them on Oct. 21 in releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution and added them to its Known Exploited Vulnerabilities catalog on Oct. 26. Check Point’s advisory says the PHP flaws could permit remote code execution through firewall web interfaces.
Check Point says its gateway hotfix for PHP2Shell was available Oct. 23, but the subsequent root-access vulnerability was distinct. According to its report, the attackers used the initial access to run code with limited privileges, then exploited CVE-2026-123039 in the Gaia operating system to obtain root. Check Point rates that flaw 7.8 out of 10 and says exploitation requires code execution already on the appliance.
The vendor’s report describes attackers placing web shells in a directory used by the Mobile Access portal and installing a back door. CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on Nov. 13 and directed US federal agencies to act by Nov. 16. Check Point’s listed hotfix levels include Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says R81.10 and older versions are past end of support.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who was responsible remains unknown. Check Point has not attributed the operation with confidence. The vendor said the back door belongs to a malware family that ESET has linked to a China-nexus group, but it also noted that the destructive activity and Israel-focused targeting do not fit that group’s known interests. That association is not confirmation that the group carried out these attacks.
The overall number of vulnerable or compromised gateways is also not established by the report. Check Point’s “couple of dozen” figure applies to unpatched systems compromised in the observed incidents, and the company did not present it as a global count. The available account does not establish whether further victims or incidents will be identified, or how many organizations experienced data loss on ESXi systems.
Check Point reported no evidence of destructive activity in the Nov. 2 wave, but that finding is limited to the incidents it examined. The source material also does not provide a complete outcome for every investigation or confirm whether all affected organizations have contained the intrusions.
Patch, Then Check for Intrusions
Organizations using Check Point Management Servers or Security Gateways should apply the November Jumbo Hotfix at the appropriate release level, prioritizing internet-facing Mobile Access portals. Check Point also advises examining every gateway that was exposed for the compromise indicators in its advisory; installing a fix does not, by itself, establish that a previously exposed device was never compromised.
Administrators should confirm that systems are on supported versions and consult Check Point’s advisory for the applicable hotfix and investigation steps. The vendor says R81.10 and older versions are past end of support, so organizations on those releases need to address that status through the vendor’s current guidance. US federal agencies face the separate CISA deadline of Nov. 16, 2026, to act on CVE-2026-123039.
Further reporting from Check Point, CISA and affected organizations may clarify the operation’s reach, the impact on ESXi systems and attribution. Until then, the confirmed account is limited to the incidents Check Point investigated, and organizations should distinguish evidence of exposure from evidence that an attacker successfully gained access.
Key Questions
Which Check Point systems should be patched?
Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, with internet-facing Mobile Access portals first. The applicable take depends on the product release; the vendor lists Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. CISA says they allow unauthenticated remote code execution. In the reported Check Point attacks, the vulnerabilities were reached through the gateways’ Mobile Access portals.
Did every attack include a wiper?
No. Check Point reported wiper activity against VMware ESXi hosts in some incidents in the first, Israel-focused wave. The company said it found no evidence of destructive activity in the second wave on Nov. 2.
Has Check Point identified the attackers?
No. Check Point said it could not assess the operation’s nature with high confidence. It reported a possible malware-family link to a China-nexus group, based on an association ESET has made, but that does not confirm who conducted the attacks.
Source: ThorstenMeyerAI.com
