🔍 Read the full analysis: Check Point Gateway Security: Understanding PHP2Shell And Wiper Risks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a couple of dozen unpatched Security Gateways in one region between October 30 and November 4, using PHP2Shell flaws and a separate root-access vulnerability. Some attacks against Israeli organizations led to a wiper being run on VMware ESXi hosts; a later wave showed no evidence of destructive activity. Check Point released a hotfix, and CISA gave U.S. federal agencies until November 16 to address the root flaw.
Check Point says attackers compromised a couple of dozen unpatched Security Gateways between October 30 and November 4 by exploiting PHP flaws and a separate vulnerability that allowed root access. In some incidents involving Israeli organizations, attackers moved from a gateway to a VMware ESXi server and ran a data-wiping program; Check Point reported no evidence of destructive activity in a second wave. The disclosure matters because the attacks combined a known route into exposed portals with a root-level flaw that had not yet been publicly fixed.
Check Point’s November 12 investigation says the attackers reached vulnerable gateways through the Mobile Access portal, using two critical PHP vulnerabilities collectively referred to as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. The flaws could allow unauthenticated remote code execution, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Check Point said its hotfix addressing PHP2Shell on its gateways had been available on October 23, a week before the observed attacks began.
After gaining limited code execution, the attackers used CVE-2026-123039 to obtain root privileges on the appliance, Check Point said. The company disclosed that vulnerability and included a fix in its November Jumbo Hotfix. The investigation describes the attackers planting web shells and a back door designed to survive a restart. In some of the first-wave incidents, the attackers then reached an ESXi host and launched a wiper called destroy_v6, which by default overwrites files with zeros before deleting them. Its accompanying note, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to Check Point.
Check Point said the first wave targeted Israeli organizations. A second wave on November 2 targeted organizations in multiple countries, with no evidence of destructive activity in those incidents. The company said only a couple of dozen unpatched systems in a single region were compromised in the incidents it observed. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13 and set November 16 as the deadline for U.S. federal agencies to act.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Could Reach ESXi Data
The incidents show how an exposed network appliance can become a route to systems beyond the appliance itself. Check Point says attackers chained remote code execution with a root-access flaw, then in some cases moved to VMware ESXi hosts and ran destructive software. For organizations that depend on virtualized systems, that creates a risk of data loss and operational disruption, not just unauthorized access to a gateway.
The reported scope is limited to the incidents Check Point observed: a couple of dozen systems in one region. That figure does not establish how many other systems were vulnerable or whether additional compromises occurred. The separate November 2 wave also shows why defenders should not assume that every intrusion had the same aim or outcome: Check Point reported no evidence of wiping in that wave.
The timing highlights a practical exposure gap. The PHP project had released fixes for the PHP flaws, and Check Point says its gateway hotfix was available before the observed attacks. However, CVE-2026-123039 was a different issue; its fix was released in the November Jumbo Hotfix. Organizations need to address both the gateway software and signs of past access, because installing a patch does not by itself establish whether an attacker had already entered.
Products Worth Considering
Bose QuietComfort Wireless Headphones – Twilight Blue (Limited Edition)
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
LG UltraGear 34-inch Curved OLED Gaming Monitor, WQHD 1440p, 240Hz, 0.03ms, 800R
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
PHP2Shell refers to two critical flaws in PHP, a programming language used in websites and embedded in some network appliances. The PHP project fixed the flaws on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes them as allowing unauthenticated remote code execution. It added both to its exploited-vulnerabilities catalog on October 26 and cautioned that PHP may be embedded in other products, so its use is not always apparent to system owners.
In Check Point’s account, PHP2Shell provided the initial code execution on the gateway, while CVE-2026-123039 enabled the jump to root. Check Point rates the root flaw 7.8 out of 10, or high severity, and says it requires an attacker to already have local code execution on the appliance. The attacks the company investigated began October 30 and ended November 4. Check Point published its investigation, advisory and fixes on November 12.
Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The minimum cited takes are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says R81.10 and older are past end of support. Administrators should also review exposed gateways for the compromise indicators in Check Point’s advisory.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Wider Exposure Unknown
Who carried out the attacks remains unconfirmed. Check Point said the evidence does not support a high-confidence assessment of the operation. The back door is associated with a malware family that ESET has linked to a China-nexus group, but the source material says the destructive, Israel-focused activity does not fit that group’s known interests. That association alone does not establish who was responsible.
The number of systems Check Point reported as compromised is not a count of all vulnerable or exposed gateways. It is also not clear from the available account whether there were compromises outside the investigated incidents, or whether every affected organization has identified and removed any back door. Check Point reported no evidence of destructive activity in the second wave, but that finding is limited to the evidence it examined. The full extent of any data loss and the impact on affected organizations have not been established.
Patch, Then Check for Intrusions
Organizations using Check Point Security Gateways should install the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with internet-facing Mobile Access portals. Administrators should match their software release to the minimum take listed by Check Point and consult its advisory for the relevant indicators of compromise. They should also review systems that were exposed during the attack period; patching closes a vulnerability but does not prove that a system is clean.
U.S. federal agencies face a specific deadline: CISA’s catalog entry requires action on CVE-2026-123039 by November 16. The next clear developments would be further incident findings, any revised attribution assessment, and confirmation from affected organizations about remediation. The provided information does not state whether Check Point plans additional disclosures or whether investigators have identified all affected networks.
Key Questions
What is PHP2Shell in this incident?
PHP2Shell is the name used for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. CISA says they can allow unauthenticated remote code execution. Attackers used them to gain initial access through vulnerable Check Point Mobile Access portals, according to Check Point.
What did the attackers do after entering a gateway?
Check Point says they used CVE-2026-123039 to gain root access, planted web shells and a back door, and in some first-wave incidents moved to a VMware ESXi host and ran the destroy_v6 wiper. The company reported no evidence of destructive activity in the second wave.
Which systems should administrators update?
Check Point recommends the November Jumbo Hotfix for all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Its advisory lists minimum takes for R82.20, R82.10, R82 and R81.20; R81.10 and older are past end of support.
Has Check Point identified who was behind the attacks?
No. Check Point says it cannot assess the operation with high confidence. A malware-family link reported by ESET is not confirmation of the attackers’ identity, and Check Point has not attributed the incidents.
Source: ThorstenMeyerAI.com
