🔍 Read the full analysis: Check Point Gateway Response: Patch After PHP2Shell Attacks on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited PHP flaws to enter unpatched Security Gateways between Oct. 30 and Nov. 4, then used a separate flaw to gain root access and install a back door. The company included fixes in its November Jumbo Hotfix; CISA added the root-access flaw to its exploited-vulnerabilities catalog and set a Nov. 16 deadline for U.S. federal agencies. Check Point has not confidently attributed the operation.
Check Point says attackers compromised unpatched Security Gateways from Oct. 30 to Nov. 4 by exploiting PHP flaws through the devices’ Mobile Access portal, then using a separate vulnerability to gain root access. The company published a security investigation and fixes in its Nov. 12 Jumbo Hotfix; on Nov. 13, CISA added the root-access flaw to its catalog of exploited vulnerabilities and ordered U.S. federal agencies to act by Nov. 16.
Check Point’s investigation describes a two-stage intrusion. Attackers first used PHP2Shell, the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to run code through exposed Mobile Access portals on gateways that had not received the relevant fix. They then exploited CVE-2026-123039, a flaw in the appliance’s Gaia operating system, to elevate their access to root.
Check Point says it observed compromises on “only a couple of dozen unpatched systems, in a single region”. In incidents involving Israeli organizations, attackers in some cases moved from the gateway to a VMware ESXi server and ran a wiper called destroy_v6. The program overwrites files with zeros and deletes them, according to the supplied investigation. Its associated note, DREAM_ANNEXATION.txt, rejects ransom negotiations. A separate wave on Nov. 2 targeted organizations in multiple countries, with Check Point reporting no evidence of destructive activity in that wave.
The company says a PHP2Shell hotfix for its gateways was available on Oct. 23, before the reported attacks began. The separate root-access flaw was disclosed, with its fix, on Nov. 12. Check Point advises installing the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for indicators of compromise. Listed minimum fixes include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Could Reach Internal Servers
The incident shows how a vulnerability in an internet-facing gateway can become a route into other parts of a company’s network. In the cases described by Check Point, attackers first gained limited code execution through the portal, then used a second flaw to obtain root-level control of the appliance. That access enabled them to install a persistent back door and, in some incidents, move to an ESXi server.
The reported wiper activity raises the stakes beyond unauthorized access: overwriting and deleting files can disrupt systems and destroy data. However, Check Point’s account distinguishes the Israeli-focused destructive incidents from the Nov. 2 wave, for which it said it found no evidence of destructive activity. The available material does not establish how many organizations were affected beyond the company’s estimate of compromised systems.
For administrators, the response is time-sensitive because the attack path involved an internet-facing service and the second vulnerability can turn an initial foothold into full appliance control. CISA’s deadline applies to U.S. federal agencies; other organizations should follow Check Point’s patch and investigation guidance. Security updates reduce exposure, but they do not establish that a previously exposed device was not compromised.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 24-Inch Full HD IPS Gaming Monitor, 120Hz (144Hz Overclocked), 1ms MBR, G-SYNC Compatible, FreeSync, HDR10
Trezor Safe 7 Crypto Hardware Wallet with Bluetooth and Color Touchscreen
As an affiliate, we earn on qualifying purchases.
Two Vulnerabilities, Different Fix Timelines
PHP2Shell refers to two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. The PHP project fixed them on Oct. 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added those PHP flaws to its Known Exploited Vulnerabilities catalog on Oct. 26. Because software appliances can include PHP within their own web interfaces, users generally depend on the device maker to distribute an appliance-specific update.
Check Point’s reported chain paired those PHP flaws with a separate issue in Gaia’s DynamicCLI helper service. Check Point rates CVE-2026-123039 7.8 out of 10, or high severity, and says exploitation requires code execution on the appliance already. The PHP vulnerabilities supplied that initial access in the attacks described. Check Point says the PHP hotfix was available before the observed activity, while the root flaw’s fix arrived in the Nov. 12 Jumbo Hotfix.
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on Nov. 13 and gave U.S. federal agencies until Nov. 16 to act. The supplied material also says Check Point versions R81.10 and older are beyond end of support, a status that affects the available maintenance path for those systems.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Full Scope Remain Open
Check Point has not attributed the operation with high confidence. The supplied report says the back door belongs to a malware family ESET has linked to a China-nexus group, but adds that the destructive activity focused on Israel does not fit that group’s known interests. That association is a lead, not confirmation that the group carried out these attacks.
The company’s “couple of dozen” figure refers to unpatched systems compromised in the incidents it observed, in a single region. The source material does not give a total for systems exposed to attack, identify every affected organization, or establish whether additional compromises went undetected. It also does not quantify the number of ESXi servers affected or the resulting data loss.
Check Point reports no evidence of destructive activity in the Nov. 2 wave, but that statement is limited to the evidence described in its investigation. The available material does not say whether every exposed gateway has been examined or whether further attack attempts continued after Nov. 4.
Patch, Then Check Exposed Gateways
Organizations using Check Point Management Servers or Security Gateways should install the November Jumbo Hotfix at the listed minimum release levels, with internet-facing Mobile Access portals prioritized. Administrators should then inspect every exposed gateway using the compromise indicators in Check Point’s advisory; applying a patch does not by itself determine whether an attacker previously gained access.
U.S. federal agencies face CISA’s Nov. 16 remediation deadline for CVE-2026-123039. Operators on R81.10 or older should check their support status and the vendor’s current guidance, since those versions are listed as beyond end of support. The supplied information does not specify an alternative fix path for those releases.
Further details depend on additional findings from Check Point, affected organizations and incident responders. Readers should watch for updated vendor advisories and any new CISA guidance on the flaw, scope of exploitation or remediation requirements.
Key Questions
Which Check Point vulnerability did CISA add to its exploited-vulnerabilities catalog?
CISA added CVE-2026-123039, the root-access flaw Check Point says attackers used after gaining code execution on a gateway. CISA issued the catalog update on Nov. 13 and gave U.S. federal agencies until Nov. 16 to act.
What should Check Point administrators do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Then check exposed gateways for the compromise indicators in Check Point’s advisory. The listed minimums include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20.
Did the attacks destroy data?
Check Point says attackers ran the destroy_v6 wiper in some incidents involving Israeli organizations; the program overwrites files with zeros and deletes them. The company reported no evidence of destructive activity in the separate Nov. 2 wave. The source material does not quantify total data loss.
Who was responsible for the attacks?
That remains unconfirmed. Check Point says the evidence does not allow high-confidence attribution. A malware-family link reported by ESET is not proof that the associated group conducted this operation.
Source: ThorstenMeyerAI.com
