🔍 Read the full analysis: PHP2Shell To Wiper: What Check Point Gateway Admins Should Know on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell flaws and a second vulnerability to gain root access. Some incidents involved a wiper on VMware ESXi servers, while a separate wave showed no evidence of destructive activity. The vendor says fixes are in its November Jumbo Hotfix; attribution remains uncertain.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, using PHP2Shell vulnerabilities to enter through Mobile Access portals and a second flaw to gain root access. In some cases, the intruders moved to VMware ESXi servers and ran a data-wiping program; Check Point says a separate wave showed no evidence of destructive activity. The vendor published an investigation and fixes on November 12, while the attackers’ identity remains unclear.
Check Point’s November 12 investigation describes a chain beginning with PHP2Shell, the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Attackers targeted unpatched gateways through their Mobile Access portals, obtaining code execution as the portal service account. They then exploited CVE-2026-123039 to gain root privileges on the appliance.
Check Point says the intruders placed web shells in the portal’s login-page directory and installed TSGA, a back door designed to persist after a restart. The report describes evidence including PHP session files associated with exploitation and repeated segmentation faults in portal web workers. These are findings from Check Point’s investigation, not an independent accounting of every affected system.
In the first wave, which Check Point says targeted Israeli organizations, attackers sometimes moved from a gateway to a VMware ESXi host and ran destroy_v6. The program overwrites files with zeros before deleting them. It left a note named DREAM_ANNEXATION.txt that, according to Check Point, explicitly rejected ransom negotiations. A second wave on November 2 targeted organizations in multiple countries; Check Point reported no evidence of destructive activity in that wave.
Check Point said only “a couple of dozen unpatched systems, in a single region” were compromised in the incidents it observed. That figure describes the vendor’s investigation and should not be read as a count of all potentially exposed devices or activity outside its visibility.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Became a Route to Destruction
The reported sequence matters because a gateway sits at a network boundary, but the incident did not stop there. After using the web-facing portal to get code execution, attackers used a separate weakness to obtain root-level control of the appliance. Check Point says that access enabled them to establish persistence and, in some cases, reach an ESXi host and destroy data.
The report describes different outcomes across two waves: wiper activity in some Israeli incidents and no observed destructive activity in the later, geographically broader wave. That distinction is important for response planning. A compromised gateway may signal a risk to systems beyond the appliance, but the available account does not establish that every affected organization experienced data destruction or that every breach led to lateral movement.
For administrators, the practical concern is the combination of an internet-facing entry point and a flaw that can turn limited code execution into root access. Applying the vendor’s fixes and checking exposed devices for signs of compromise are separate steps: installing a hotfix addresses the vulnerabilities, but does not by itself establish that an already compromised system is clean.
Popular right now
eufy E25 Robot Vacuum and Mop with HydroJet Roller Mop
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
Breville Barista Express Espresso Machine with Built-In Grinder, Brushed Stainless Steel
As an affiliate, we earn on qualifying purchases.
Two Vulnerabilities, Different Fix Timelines
PHP fixed the two PHP2Shell vulnerabilities on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes them as enabling unauthenticated remote code execution in PHP and added them to its Known Exploited Vulnerabilities catalog on October 26. PHP can be embedded in appliances, so users depend on device manufacturers to deliver fixes through product updates.
Check Point says its hotfix for PHP2Shell on the gateways was available on October 23, before the attacks it investigated began. CVE-2026-123039 was a separate root-access flaw: Check Point disclosed it and included its fix in the November Jumbo Hotfix on November 12. The attack report says the second flaw required local code execution, which the PHP2Shell chain had provided.
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on November 13 and set November 16 as the deadline for U.S. federal agencies to act. Check Point’s recommended update covers Management Servers and Security Gateways, with internet-facing Mobile Access portals prioritized. The source lists minimum hotfix takes: Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. It says R81.10 and older versions are past end of support.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks has not been established. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source says the destructive, Israel-focused activity does not fit that group’s known interests. Check Point says its evidence is insufficient for a high-confidence assessment. The malware link alone does not confirm who operated it in these incidents.
The reported count is limited to the systems Check Point observed, and the source does not provide a complete independent tally of affected organizations or devices. It also remains unclear from the available material whether every compromised gateway was found, whether any data was recovered from systems hit by the wiper, or whether the later wave involved additional activity not observed by Check Point.
Administrators should distinguish vulnerability remediation from incident assessment. The source advises applying the hotfix and checking exposed gateways for indicators listed by Check Point, but it does not establish that patching alone removes an existing back door or resolves compromise of connected infrastructure.
Patch Gateways and Check for Persistence
Check Point’s guidance is to install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Administrators should verify that their installed release meets the listed minimum take and account for unsupported versions, including R81.10 and older, which the source says are past end of support.
After updating, teams should review every gateway that was exposed against the indicators and investigative steps in Check Point’s advisory. That review should account for the reported web shells, TSGA back door and the possibility of movement to VMware ESXi systems. CISA’s November 16 deadline applies to U.S. federal agencies; the source does not describe it as a deadline for other organizations.
Further clarity will depend on additional technical findings from Check Point, CISA or other investigators, and on whether affected organizations report confirmed impacts. Until attribution and the full scope are clearer, the established account remains limited to the attacks Check Point investigated and the activity it says it observed.
Key Questions
What is PHP2Shell in this incident?
PHP2Shell refers to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Check Point says attackers used them through unpatched Mobile Access portals to obtain code execution on affected gateways.
What did CVE-2026-123039 allow attackers to do?
Check Point says the second flaw let attackers with code execution on the appliance reach root privileges. The vendor rates it 7.8 out of 10 and included its fix in the November Jumbo Hotfix.
Did every compromised gateway lead to a wiper attack?
No such conclusion is confirmed. Check Point reported wiper activity on some incidents in the first wave and no evidence of destructive activity in the second wave it described.
What should Check Point administrators do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Then check exposed systems against Check Point’s listed indicators of compromise; a patch does not by itself establish that a previously compromised device is clean.
Who was behind the attacks?
Attribution remains uncertain. Check Point says it cannot assess the operation with high confidence. A link between the back-door family and a China-nexus group has been reported, but that does not confirm who conducted these attacks.
Source: ThorstenMeyerAI.com
