🔍 Read the full analysis: From PHP2Shell Access To Wiper Malware On Check Point Gateways on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways between October 30 and November 4, using PHP2Shell flaws and a separate vulnerability to gain root access. Some intrusions targeting Israeli organizations reached VMware ESXi servers and ran a wiper; the company says a second wave showed no evidence of destructive activity. Check Point’s November Jumbo Hotfix addresses the flaws, while the attackers’ identity remains uncertain.
Check Point says attackers compromised unpatched Security Gateways from October 30 to November 4 by exploiting PHP2Shell flaws and a separate vulnerability that gave them root access. In some incidents involving Israeli organizations, the attackers moved from a gateway to a VMware ESXi server and ran data-wiping malware; the company says it found no evidence of destructive activity in a second wave targeting organizations in multiple countries.
Check Point published its investigation, a security advisory and fixes on November 12. The company says attackers first reached gateways through their Mobile Access portals using two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, collectively described as PHP2Shell. They then used a separate flaw, CVE-2026-123039, to gain root privileges on the appliance and install a back door.
Check Point reported that it observed “only a couple of dozen unpatched systems, in a single region” being compromised. The first wave targeted Israeli organizations. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6, which, according to the report, overwrites files with zeros before deleting them. Its note, DREAM_ANNEXATION.txt, rejects ransom negotiations. A second wave on November 2 affected organizations in multiple countries, but Check Point said it found “no evidence of destructive activity” in those incidents.
The company says a PHP2Shell hotfix for its gateways had been available on October 23, before the attacks began. The separate root-access flaw was disclosed and fixed in Check Point’s November Jumbo Hotfix on November 12. The vendor advises installing that hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for indicators of compromise. The listed minimum hotfix takes include Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point says R81.10 and older versions are past end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Breaches Reached ESXi Systems
The reported attacks show how a flaw in a network gateway can become a path to systems behind it. A gateway is positioned to manage access into an organization’s network; once attackers gained control of the appliance, some were able to move to VMware ESXi infrastructure, where a wiper could disrupt or destroy data. The reported destructive activity was limited to some cases in the first wave, not the later incidents described by Check Point.
The timing also matters for defenders. The PHP flaws had a gateway hotfix available before the observed attacks, but the separate vulnerability used to obtain root was not fixed until November 12. Organizations need to address both the initial access path and the privilege-escalation flaw, then investigate exposed gateways rather than treating installation alone as proof that no compromise occurred. CISA added CVE-2026-123039 to its catalog of exploited vulnerabilities on November 13 and set a November 16 deadline for U.S. federal agencies to act.
Popular right now
Dyson V9 Motorbar Cordless Vacuum
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer, KSM150PS, Almond Cream
Bose QuietComfort Wireless Headphones – Twilight Blue (Limited Edition)
As an affiliate, we earn on qualifying purchases.
Two Flaws Created a Gateway Chain
PHP2Shell refers to two critical flaws in PHP that can allow unauthenticated remote code execution, according to CISA. The PHP project issued fixes on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on October 26. Because PHP can be bundled inside appliances, customers may depend on the device maker to distribute a suitable update rather than updating PHP independently.
In Check Point’s account, PHP2Shell provided the initial code execution on the gateway, while CVE-2026-123039 provided root access. The company describes the latter as a flaw in a Gaia operating-system helper service called DynamicCLI. The service could accept local commands without verifying who was sending them, but exploitation required code execution already on the appliance. The two weaknesses therefore formed a chain: one enabled access, and the other elevated the attacker’s privileges.
Check Point says attackers used root access to place web shells in the Mobile Access portal’s login-page directory and install TSGA, a persistent back door. The company’s investigation covers activity from October 30 through November 4. Its public account does not establish who operated the campaign, and it cautions against treating a malware-family association as a confident attribution.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
The attackers’ identity has not been established. Check Point says the evidence does not support a high-confidence assessment of the operation. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive, Israel-focused activity does not fit that group’s known interests. That association is not proof that the group carried out the attacks.
The number of systems cited by Check Point refers to the unpatched systems it observed in the incidents it investigated. It is not a complete count of every potentially exposed gateway or every organization that may have been targeted. The available account also does not establish how many ESXi hosts or files were affected, whether all compromised systems were identified, or whether the wiper caused recoverable or permanent data loss in each case.
It remains unclear whether attackers retained access to systems beyond the reported activity through November 4. Organizations that installed a hotfix still need to determine whether an attacker had already gained access before it was applied. Check Point’s compromise indicators and any later incident disclosures may help clarify the scope.
Patch, Then Investigate Exposed Gateways
Check Point’s immediate guidance is to install the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with internet-facing Mobile Access portals. Administrators should confirm that devices are running the applicable minimum take for their supported release and review every exposed gateway for the indicators listed in the company’s advisory. Systems on R81.10 or older are past end of support, according to Check Point, and require a supported path forward.
For U.S. federal agencies, the next stated deadline is November 16, set by CISA after it added CVE-2026-123039 to its exploited-vulnerability catalog on November 13. The immediate security work is to apply the vendor fixes and assess whether systems were compromised, including any connected virtualization infrastructure. Further findings may change what is known about the number of affected organizations, the extent of destructive impact and who was responsible.
Key Questions
What happened to the Check Point gateways?
Check Point says attackers used two PHP2Shell flaws to gain code execution through Mobile Access portals, then exploited CVE-2026-123039 to obtain root access and install a back door. The company investigated attacks from October 30 through November 4.
Did the attacks destroy data?
In some incidents in a first wave targeting Israeli organizations, attackers reached VMware ESXi hosts and ran a wiper called destroy_v6. Check Point reported no evidence of destructive activity in the second wave. The available information does not state how much data was lost overall.
Which Check Point systems should administrators update?
Check Point advises installing its November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The vendor lists minimum takes for supported releases and says R81.10 and older are past end of support.
Who carried out the attacks?
That has not been determined. ESET has linked the back-door malware family to a China-nexus group, but Check Point says it cannot assess the operation’s true nature with high confidence. The reported malware association alone does not identify the attackers.
Source: ThorstenMeyerAI.com
