🔍 Read the full analysis: How Attackers Hit Check Point Gateways And What To Update on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell to gain access and a second flaw to reach root privileges. Some attacks against Israeli organizations moved to VMware ESXi servers and ran a data-destroying wiper; a separate wave showed no evidence of destructive activity. Check Point advises installing its November Jumbo Hotfix and checking exposed systems for signs of compromise.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4 by exploiting two PHP flaws through the Mobile Access portal, then using a separate vulnerability to gain root access. The company’s November Jumbo Hotfix addresses the root-access flaw, while the attacks’ limited reported scope and the possibility of destructive activity make patching and checks for compromise urgent priorities for affected organizations.
In an investigation published November 12, Check Point said it observed a couple of dozen unpatched systems in one region being compromised. The initial access involved PHP2Shell, the name used for CVE-2026-109618 and CVE-2026-109619, critical PHP vulnerabilities reached through gateways’ Mobile Access portals. Check Point says a separate flaw, CVE-2026-123039, then let attackers escalate from code execution to root, the appliance’s highest-privilege account.
The consequences differed between waves. Check Point reported that the first wave targeted Israeli organizations; in some cases, attackers moved from a gateway to a VMware ESXi server and ran a wiper called destroy_v6. The program overwrites files with zeros and deletes them. A note left by the malware, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations, according to Check Point. A second wave on November 2 targeted organizations in multiple countries, but Check Point said it found no evidence of destructive activity in that wave.
Check Point released its investigation, advisory and fixes on November 12. It recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and examining exposed appliances for the indicators in its advisory. The cited minimum hotfix levels are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says versions R81.10 and older are past end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Led to Data Destruction
The incident shows how compromise of a network gateway can become a path into other systems. Attackers first reached a service exposed through Mobile Access, then used a second flaw to obtain root privileges on the appliance. In some observed cases, they moved onward to VMware ESXi and ran software designed to destroy data. That sequence makes the issue relevant beyond organizations that use the gateway itself: connected infrastructure may also need investigation.
The reported scope is limited to the incidents Check Point observed: a couple of dozen unpatched systems in one region. That figure does not establish how many systems were exposed or whether other organizations were affected. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13 and set a November 16 deadline for U.S. federal agencies to act, underscoring the need for prompt remediation in that sector.
Products Worth Considering
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
DJI Mini 3 Drone with DJI RC and 3‑Axis Mechanical Gimbal
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Display, Black
As an affiliate, we earn on qualifying purchases.
Two Flaws, Separate Fix Timelines
The PHP flaws and the root-access flaw had different disclosure and patch timelines. The PHP project released fixes on October 21 for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the PHP vulnerabilities as allowing unauthenticated remote code execution. Check Point says its gateway hotfix for PHP2Shell was available on October 23, before the observed attacks began on October 30. The gateway vulnerability was later listed in CISA’s catalog on October 26.
The second flaw was not the same PHP issue. Check Point says the Gaia operating system’s DynamicCLI helper service ran as root and accepted commands through a world-writable local socket without checking the caller. The company rated CVE-2026-123039 7.8 out of 10, high severity, and said it required an attacker to have already achieved local code execution. Check Point disclosed the flaw and its Jumbo Hotfix on November 12.
PHP can be embedded in appliances and other products, so updating PHP itself may not update the software in a network device; customers may need the device maker’s patch. CISA warns that PHP may be a component of other software and that older unsupported PHP versions should not remain online until updated. For Check Point customers, the vendor’s specified appliance hotfixes are the immediate remediation path.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks remains unconfirmed. Check Point said its evidence does not support a high-confidence assessment of the operation’s true nature. The back door is associated with a malware family that ESET has linked to a China-nexus group, but the source material notes that the destructive activity and focus on Israeli organizations do not fit that group’s known interests. That mismatch is not proof of who was responsible.
The number of compromised systems reported by Check Point covers the incidents it observed, not necessarily all attempted attacks or exposed devices. The available account also does not establish whether the November 2 wave affected systems outside the observed cases, whether all compromised gateways were identified, or whether any data was recovered after wiper activity. Organizations must compare their own logs and systems with Check Point’s advisory rather than assume they were unaffected.
Patch, Then Check Exposed Gateways
Organizations using Check Point Management Servers or Security Gateways should install the November Jumbo Hotfix at the version-specific minimum listed in the vendor advisory, giving internet-facing Mobile Access portals priority. They should then review every gateway that was exposed for Check Point’s listed indicators of compromise. Patching addresses the vulnerabilities, but it does not by itself establish that a previously exposed device was never compromised.
U.S. federal agencies face CISA’s stated November 16, 2026 deadline for action on CVE-2026-123039. Organizations running R81.10 or earlier should account for the fact that those versions are past end of support and consult Check Point’s guidance on supported remediation. Further details may emerge as the vendor, CISA and affected organizations investigate; a confident public attribution has not been made.
Key Questions
What did attackers exploit on Check Point gateways?
Check Point says attackers used PHP2Shell, comprising CVE-2026-109618 and CVE-2026-109619, through the Mobile Access portal to gain code execution. They then exploited CVE-2026-123039 to obtain root privileges.
Which update should Check Point customers install?
Check Point advises installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Minimum cited levels are Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20.
Did the attacks destroy data?
Check Point says that in some incidents in the first wave, attackers reached VMware ESXi servers and ran destroy_v6, a wiper that overwrites files with zeros and deletes them. The company reported no evidence of destructive activity in the separate November 2 wave.
Who was responsible for the campaign?
Responsibility has not been established. Check Point said the available evidence does not allow a high-confidence assessment. A malware-family link reported by ESET is not, by itself, confirmation of attribution.
Source: ThorstenMeyerAI.com
