🔍 Read the full analysis: Check Point Gateway Attacks And The Patches That May Help on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers used flaws in Security Gateway Mobile Access portals between October 30 and November 4, then exploited a separate vulnerability to gain root access. The company’s November Jumbo Hotfix addresses the root flaw and includes fixes for the PHP vulnerabilities; CISA has directed US federal agencies to act on the root flaw by November 16.
Check Point says attackers compromised unpatched Security Gateways from October 30 to November 4, using flaws in the Mobile Access portal and a separate vulnerability to gain root access. The company published its investigation and a fix in the November Jumbo Hotfix on November 12; CISA added the root-access flaw, CVE-2026-123039, to its exploited-vulnerabilities catalog on November 13 and set a November 16 deadline for US federal agencies.
According to Check Point Research, attackers first exploited two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. The flaws enabled unauthenticated remote code execution through exposed Mobile Access portals on gateways that had not received the relevant fix. The attackers then used CVE-2026-123039 to move from code execution with limited privileges to root access on the appliance.
Check Point says its investigation found that only a couple of dozen unpatched systems in one region were compromised in the incidents it observed. In a first wave targeting Israeli organizations, attackers moved from some gateways to VMware ESXi hosts and ran a wiper called destroy_v6, which overwrites files with zeros before deleting them. The accompanying file, DREAM_ANNEXATION.txt, rejects ransom negotiations. A second wave on November 2 targeted organizations in multiple countries; Check Point reported no evidence of destructive activity in that wave.
The company says a PHP2Shell hotfix for gateways was available on October 23, before the observed attacks began. The separate root-access vulnerability was disclosed and patched in the November 12 Jumbo Hotfix. Check Point recommends applying that hotfix to all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for the indicators in its advisory. Its minimum listed releases include Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Root Access Raises the Stakes
The reported sequence matters because the attackers could turn an internet-facing gateway into a foothold with full administrative control. A gateway sits between an organization and its network; compromise can provide a route to other systems. Check Point’s account says attackers used that access to plant a persistent back door, and in some observed cases reached VMware ESXi hosts and ran destructive software.
The reported scope is limited to a couple of dozen compromised unpatched systems in one region, according to the vendor, but that figure describes the incidents Check Point observed—not necessarily every affected system. CISA’s catalog listing adds urgency for federal agencies, which have until November 16 to act. Organizations using the affected gateways face both a patching task and a need to investigate whether an exposed device was compromised before the fix was installed.
Popular right now
Hisense 40-Inch QD4SR Series Hi-QLED FHD Roku Smart TV
eufy E25 Robot Vacuum and Mop with HydroJet Roller Mop
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, White
As an affiliate, we earn on qualifying purchases.
Two Vulnerabilities in Sequence
PHP2Shell refers to two critical vulnerabilities in PHP. The PHP project fixed them on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA says the flaws allow unauthenticated remote code execution and added them to its Known Exploited Vulnerabilities catalog on October 26. Check Point’s advisory says the PHP issues may allow remote code execution through firewall web interfaces.
Appliances can include PHP as part of their web-facing software, so users generally depend on the appliance maker to provide and distribute the relevant update. In this reported intrusion, PHP2Shell provided initial code execution, while CVE-2026-123039 supplied the route to root. Check Point describes the latter as a flaw in a Gaia helper service and rates it 7.8 out of 10, high severity; exploitation requires the attacker to already have local code execution.
Check Point says versions R81.10 and older are past end of support. The company’s recommended minimum hotfix takes apply to supported releases, so organizations running older versions should consult Check Point’s support guidance rather than assume they can install the same take.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks remains unknown. Check Point says it cannot assess the operation’s nature with high confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source account says the destructive activity focused on Israeli organizations does not fit that group’s known interests. That association is not proof that the group was responsible.
The number of affected organizations outside the cases investigated by Check Point is also unclear. The company reported a couple of dozen compromised unpatched systems in one region, but did not establish that this captures every intrusion or identify all victims. It is also not clear from the available account how many organizations installed the earlier PHP2Shell hotfix before the attacks, or how many later applied the November Jumbo Hotfix.
Check Point’s account describes wiper activity in some cases in the first wave and no evidence of destructive activity in the second. Those findings do not establish that every compromised system was wiped, nor do they rule out activity that investigators have not identified. The extent of any data loss and the attackers’ purpose have not been confirmed.
Patch, Then Investigate Exposed Gateways
Organizations should follow Check Point’s advisory by installing the November Jumbo Hotfix on Management Servers and Security Gateways, with internet-facing Mobile Access portals first. Administrators should verify the exact release and take installed against Check Point’s published minimums, then review every exposed gateway for the company’s listed signs of compromise. A successful patch does not by itself establish that an earlier intrusion did not occur.
US federal agencies covered by CISA’s directive must meet the stated November 16 deadline for CVE-2026-123039. Other operators should consult their security and incident-response teams, check whether their versions remain supported, and use Check Point’s advisory for the relevant indicators and remediation guidance. Further information about victims, attribution and any additional destructive activity may emerge as investigations continue.
Key Questions
Which Check Point systems should be patched?
Check Point recommends the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The vendor lists minimum takes for R82.20, R82.10, R82 and R81.20; administrators should confirm the appropriate take for their release in the advisory.
What did CVE-2026-123039 allow attackers to do?
Check Point says the flaw allowed an attacker who already had local code execution on a gateway to reach root-level access. In the reported sequence, PHP2Shell provided the initial execution that made the second flaw useful.
Were all compromised organizations hit by the wiper?
No. Check Point reported wiper activity in some cases during the first wave targeting Israeli organizations. It said it found no evidence of destructive activity in the second wave on November 2. The available account does not establish that every compromised system was wiped.
Has Check Point identified the attackers?
No. Check Point says it cannot attribute the operation with high confidence. A malware-family link reported by ESET is an association, not confirmation of who carried out these attacks.
Source: ThorstenMeyerAI.com
