🔍 Read the full analysis: The Check Point Gateway Exploit Path: From PHP2Shell To Wiper on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways from October 30 to November 4, using PHP flaws to get in and a separate vulnerability to gain root access. Some intrusions reached VMware ESXi servers and launched a wiper; Check Point has not attributed the attacks with confidence. CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13 and set a November 16 action deadline for U.S. federal agencies.
Check Point says attackers compromised a small number of unpatched Security Gateways between October 30 and November 4, using PHP vulnerabilities to gain access and a separate flaw to obtain root privileges. In some cases, the intruders moved to VMware ESXi servers and ran a data-destroying wiper; the company has not identified the operator with confidence. The U.S. Cybersecurity and Infrastructure Security Agency added the root-access flaw to its exploited-vulnerabilities catalog on November 13, giving federal agencies until November 16 to act.
In an investigation published November 12, Check Point described a two-stage intrusion against gateways whose Mobile Access portals were exposed and unpatched. Attackers used two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell, to run code through the web-facing portal. That access initially ran with the portal service’s limited permissions. The attackers then exploited CVE-2026-123039, a flaw in the gateway’s Gaia operating system, to escalate to root, the appliance’s highest-privilege account.
Check Point said the first observed wave targeted Israeli organizations. In some of those cases, attackers moved from a gateway to a VMware ESXi host and launched a wiper named destroy_v6, which, by default, overwrites files with zeros before deleting them. The malware left a note named DREAM_ANNEXATION.txt that, according to Check Point, explicitly rejected ransom negotiations. A second wave on November 2 affected organizations in multiple countries, but Check Point said it found no evidence of destructive activity in that wave.
The company said it observed compromises of “only a couple of dozen unpatched systems, in a single region.” It released its investigation, advisory and fixes on November 12. Check Point’s PHP2Shell hotfix for gateways had been available October 23, before the attacks began, but the fix for the separate root flaw appeared in the November Jumbo Hotfix. The company recommends installing that hotfix on management servers and gateways, starting with internet-facing Mobile Access portals, and checking exposed devices for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Became a Destructive Route
The incidents show how a vulnerability in a network appliance can become a route to systems beyond the appliance itself. The attackers reportedly combined web-facing code execution with a second flaw that converted limited access into root control, then in some cases used the compromised gateway to reach an ESXi host. That chain raises the stakes for organizations that rely on gateways to protect access to internal networks and infrastructure.
The confirmed wiper activity was limited to some cases in the first wave described by Check Point; the company reported no destructive activity in the second wave. Still, the difference between an intrusion that remains on a gateway and one that reaches virtualization infrastructure can affect recovery plans, data availability and business operations. CISA’s November 16 deadline also makes the issue a near-term compliance matter for U.S. federal agencies, not just a general patching concern.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Jackery Solar Generator 1000 v2 with 100W Solar Panel
DJI Mic 3 (2 TX + 1 RX + Charging Case) Wireless Microphone
As an affiliate, we earn on qualifying purchases.
Two Flaws Completed the Intrusion
PHP2Shell refers to two critical PHP flaws, each rated 9.2 out of 10 on the Common Vulnerability Scoring System. The PHP project fixed them on October 21 in releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution. Check Point said the vulnerabilities could be reached through its firewall web interfaces, and its gateway hotfix for them was available October 23.
The second step in the reported chain was different: CVE-2026-123039 was not the initial way into the gateway. Check Point says its DynamicCLI helper service ran as root and accepted commands over a local socket without checking the caller. The company rates that vulnerability 7.8 out of 10 and says an attacker first needed local code execution on the appliance, which PHP2Shell supplied. Check Point disclosed the root flaw and released its fix on November 12.
After obtaining root, the intruders placed PHP web shells in a directory used by the Mobile Access portal and installed a back door, according to the investigation. The supplied source describes the back door as TSGA and says it was configured to persist through a restart. The available account does not provide enough detail to establish how broadly that back door was deployed across the observed compromises.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who operated the attacks remains unconfirmed. The source material says the back door belongs to a malware family that ESET has linked to a China-nexus group, but it also notes that a destructive attack focused on Israeli organizations does not fit that group’s known interests. That association is not proof that the group carried out this campaign, and Check Point says the evidence does not support a high-confidence attribution.
The reported scope is also bounded by Check Point’s investigation: a couple of dozen systems in one region were compromised in the incidents it observed. The material does not establish how many organizations were affected overall, how many systems were exposed but not compromised, or whether other operators used the vulnerabilities outside the investigated activity. It also does not give a complete account of the wiper’s impact on affected ESXi environments or the recovery status of victims.
Check Point’s recommendation to inspect exposed gateways indicates that applying a patch alone may not establish whether a device was previously compromised. Organizations should use the indicators and checks in the vendor advisory; the supplied account does not enumerate those indicators, so their exact nature cannot be reported here.
Patch Gateways Before the Deadline
Check Point advises installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, then checking exposed devices for signs of compromise. The source lists minimum hotfix levels of Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Administrators should confirm the correct supported release and installation instructions in Check Point’s advisory before making changes.
CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13 and set November 16 as the deadline for U.S. federal agencies to act. The PHP flaws were added to that catalog on October 26, according to the source material. Administrators should also account for the stated end-of-support status of R81.10 and older versions when reviewing affected systems.
Further reporting will depend on vendor and government updates, as well as investigations by affected organizations. The immediate priorities are applying the relevant fixes, reviewing exposed gateways for compromise and determining whether any gateway access extended to internal servers or virtualization infrastructure.
Key Questions
What happened in the Check Point gateway attacks?
Check Point says attackers used two PHP vulnerabilities to run code through Mobile Access portals, then exploited CVE-2026-123039 to gain root access. In some cases, they moved to VMware ESXi servers and ran a wiper.
Which systems should administrators prioritize?
Check Point recommends the November Jumbo Hotfix for all Management Servers and Security Gateways, with internet-facing Mobile Access portals first. The vendor also advises checking exposed devices for signs of compromise.
Did every affected organization experience data destruction?
No. Check Point reported wiper activity in some cases in the first wave targeting Israeli organizations. It said it found no evidence of destructive activity in the second wave on November 2.
Who was responsible for the attacks?
That has not been established. Check Point said the evidence does not support a high-confidence assessment of the operation’s true nature. A reported connection between the back door’s malware family and a China-nexus group does not confirm that group carried out the attacks.
What is the deadline for U.S. federal agencies?
CISA gave federal agencies until November 16 to address CVE-2026-123039 after adding it to its exploited-vulnerabilities catalog on November 13.
Source: ThorstenMeyerAI.com
