🔍 Read the full analysis: The PHP2Shell-to-Wiper Threat: Check Point Gateway Patch Steps on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from Oct. 30 to Nov. 4, using PHP2Shell flaws and a separate vulnerability to gain root access. In some incidents, attackers moved to VMware ESXi servers and ran a wiper; the company says a second wave showed no evidence of destructive activity. Check Point released fixes on Nov. 12, and CISA gave US federal agencies until Nov. 16 to address CVE-2026-123039.
Check Point says attackers compromised unpatched Security Gateways between Oct. 30 and Nov. 4 by chaining PHP vulnerabilities with a separate flaw that gave them root access, and in some cases used a wiper against VMware ESXi servers. The company released fixes on Nov. 12; on Nov. 13, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the root-access vulnerability, CVE-2026-123039, to its catalog of exploited vulnerabilities and set a Nov. 16 deadline for U.S. federal agencies to act.
Check Point’s investigation says attackers first reached gateways through their Mobile Access portals, exploiting two critical PHP flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619. They then used CVE-2026-123039 to escalate from the portal’s limited service account to root-level access, allowing them to install web shells and a back door. Check Point said the incidents it observed involved “only a couple of dozen unpatched systems, in a single region.”
In a first wave targeting Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6. Check Point says the program overwrites files with zeros and deletes them. The accompanying file, DREAM_ANNEXATION.txt, “explicitly rejects ransom negotiations,” according to the company. A second wave, on Nov. 2, targeted organizations in multiple countries; Check Point reported no evidence of destructive activity in that wave.
Check Point advises customers to install its November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and to examine exposed gateways for the compromise indicators in its advisory. The minimum cited package levels are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says R81.10 and older versions are past end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Can Reach Data Servers
The incident shows how a vulnerability in a network appliance can become a route into systems beyond the appliance itself. Check Point says the attackers used one flaw to run code through a web-facing portal and another to obtain root privileges. In some cases, they then reached an ESXi host and ran software designed to destroy files. That sequence makes patching and checking for persistence separate tasks: installing a fix closes a known route, but does not establish whether an already exposed system was accessed or altered.
CISA’s deadline gives the issue an immediate operational consequence for U.S. federal agencies, which must act by Nov. 16 under the agency’s directive. Other organizations are not covered by that deadline, but customers using the affected gateways face the same technical risk described by Check Point. Because the observed incidents were limited in number, the report does not establish the scale of exposure across all customers or the wider internet.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Cypress Green
As an affiliate, we earn on qualifying purchases.
Two Flaws, Then Root Access
The two PHP2Shell vulnerabilities affect PHP, which can be included inside other products and appliances. The PHP project issued fixes on Oct. 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as permitting unauthenticated remote code execution in PHP. Check Point’s advisory says they may allow remote code execution through firewall web interfaces.
Check Point says its gateway hotfix for PHP2Shell was available on Oct. 23, before the observed attacks began. The later root-access vulnerability was different: CVE-2026-123039 was disclosed, and its fix included in the November Jumbo Hotfix, on Nov. 12. Check Point rates the root flaw 7.8 out of 10 and says exploitation requires code execution already on the appliance—access the PHP2Shell flaws could provide. CISA added the PHP flaws to its exploited-vulnerabilities catalog on Oct. 26.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks remains unresolved. Check Point has not attributed them with confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source report says an attack focused on Israeli organizations and involving destructive activity does not fit that group’s known interests. That mismatch is not proof of who was responsible.
The full number of affected or exposed systems is also unclear. Check Point’s “couple of dozen” figure covers the compromised systems in the incidents it observed, not necessarily every vulnerable gateway. The supplied investigation excerpt does not provide a complete set of indicators or a full account of how many ESXi servers were affected. It is also not clear whether every compromised gateway was cleaned or whether additional victims will be identified.
Apply Fixes and Inspect Gateways
Organizations should install the applicable November Jumbo Hotfix on their Check Point Management Servers and Security Gateways, beginning with internet-facing Mobile Access portals. They should also review the vendor’s advisory for indicators of compromise and investigate any gateway that was exposed during the attack period. Systems running R81.10 or older are past end of support, according to Check Point, and should not be treated as covered by the listed current release packages.
U.S. federal agencies face the specific Nov. 16 CISA deadline for CVE-2026-123039. Further information may clarify the scope of compromises, the extent of any data destruction and whether investigators can attribute the operation. Until then, Check Point’s patch guidance and compromise checks are the clearest actions available from the reported findings.
Key Questions
What happened to the Check Point gateways?
Check Point says attackers exploited PHP2Shell vulnerabilities through Mobile Access portals, then used CVE-2026-123039 to gain root access and install a back door on some gateways.
Did every affected organization suffer data destruction?
No. Check Point reported wiper activity in some incidents during a wave targeting Israeli organizations. It said it found no evidence of destructive activity in the second wave on Nov. 2.
Which fix should customers install?
Check Point recommends the November Jumbo Hotfix for Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The required take depends on the product version; the company lists Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
Who is believed to be behind the attacks?
Attribution is not confirmed. Check Point says it cannot assess the operation’s nature with high confidence. A malware-family link reported by ESET does not, by itself, establish who carried out this campaign.
What is the CISA deadline?
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on Nov. 13 and gave U.S. federal agencies until Nov. 16, 2026, to act.
Source: ThorstenMeyerAI.com
