🔍 Read the full analysis: How Check Point Gateway Attacks Move From Exploit To Wiper on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP flaws to gain access and a separate vulnerability to reach root privileges. In some cases, they moved to VMware ESXi servers and ran a wiper; a second wave showed no evidence of destructive activity. The company released fixes on November 12, and CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13.
Check Point says attackers compromised unpatched Security Gateways from October 30 to November 4, using PHP vulnerabilities to gain code execution and a separate flaw to obtain root access. In some incidents involving Israeli organizations, the attackers moved to VMware ESXi servers and ran a data-destroying wiper; a later wave across multiple countries showed no evidence of destructive activity, according to the company.
Check Point’s November 12 investigation describes an attack chain that began through the Mobile Access portal on gateways that had not received the available PHP2Shell fix. The two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowed remote code execution. The attackers then used CVE-2026-123039, a separate flaw in the gateway’s Gaia operating system, to move from the portal service account to root, the system’s highest level of access.
With root privileges, the attackers planted web shells and a back door Check Point calls TSGA, which the company says was designed to persist after a restart. In some first-wave incidents, the intruders moved from the gateway to a VMware ESXi host and launched a wiper named destroy_v6. Check Point says the program overwrites files with zeros before deleting them. Its associated note, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations.
Check Point reported that the first wave targeted Israeli organizations. A second wave, beginning November 2, targeted organizations in multiple countries, but the company said it found no evidence of destructive activity in those cases. It said only “a couple of dozen unpatched systems, in a single region” were compromised in the incidents it observed. That is the vendor’s account of the investigated cases, not a measure of all potentially exposed systems.
The PHP2Shell hotfix for Check Point gateways was available on October 23, according to the company, a week before the observed attacks began. The root-access flaw was disclosed, and its fix included in the November Jumbo Hotfix, on November 12. Check Point advises installing that hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for indicators of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
How Gateway Access Reached ESXi
The reported chain shows how an internet-facing network gateway can become a route into other infrastructure. Initial code execution on the appliance was not the end of the intrusion: the attackers used a second vulnerability to gain root access, established a back door, and in some cases reached VMware ESXi systems. That can put both network security controls and hosted workloads at risk.
The distinction between the two waves matters for incident response. Check Point describes wiper activity in some first-wave cases, but says it found no evidence of destructive activity in the second wave. Organizations should not assume every affected gateway was followed by data destruction, nor that a lack of visible damage proves a system was not compromised. The report makes checking for persistence and activity beyond the gateway part of the response.
The timing also highlights the gap that can arise when a software component is fixed upstream but embedded products need a separate vendor update. PHP released fixes for the underlying flaws, while Check Point’s appliance fix had its own release schedule. Administrators need to track security notices from the makers of appliances that include third-party software, not rely only on the upstream project’s patch.
Products Worth Considering
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
As an affiliate, we earn on qualifying purchases.
Two Flaws in One Attack Chain
PHP2Shell refers here to two critical PHP vulnerabilities, both rated 9.2 out of 10 on the CVSS scale. The PHP project fixed them on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA says the flaws allow unauthenticated remote code execution. Because PHP is often bundled inside other products, users of an appliance may need to wait for and install the device maker’s update rather than patch PHP separately.
The gateway intrusion depended on a second weakness. Check Point says CVE-2026-123039 is a local privilege-escalation flaw in the DynamicCLI helper service, which runs as root. The company rates it 7.8 out of 10 and says exploitation requires code execution on the appliance first. In the reported attacks, PHP2Shell supplied that initial foothold; the second flaw then enabled root-level control.
Check Point published its investigation, advisory and fixes on November 12. On November 13, CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog and set a November 16 deadline for U.S. federal agencies to address it. Check Point’s stated minimum hotfix takes include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. The company says R81.10 and older releases are past end of support.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Still Open
Who carried out the attacks remains unconfirmed. The back door belongs to a malware family that ESET has linked to a China-nexus group, but Check Point says the available evidence does not support a high-confidence attribution. The reported destructive activity against Israeli organizations also does not fit that group’s known interests, according to the source material; that mismatch does not identify another actor.
The scope beyond the incidents Check Point observed is also unclear. Its estimate covers a couple of dozen compromised unpatched systems in one region, but the report does not establish how many gateways were exposed, whether other organizations were compromised without being detected, or whether every affected system had the same attacker activity. The source material also does not provide a complete count of ESXi hosts affected or quantify data loss.
Check Point reported PHP session-file markers and repeated web-worker crashes as evidence of exploitation, but organizations must examine their own systems to determine whether those indicators are present. The available account does not confirm that every gateway with a vulnerable configuration was attacked, or that installing the hotfix alone removes an existing back door.
Patch, Then Check for Persistence
Administrators should install the November Jumbo Hotfix on Check Point Management Servers and Security Gateways, starting with internet-facing Mobile Access portals. They should verify the applicable take for each software release, review Check Point’s advisory for its full list of indicators, and investigate exposed appliances for signs of compromise. Systems on unsupported versions require particular attention because they no longer receive standard support fixes.
U.S. federal agencies faced a November 16, 2026, CISA deadline for addressing CVE-2026-123039. Other organizations should follow their own applicable requirements while treating the flaw as exploited in the wild, based on its CISA catalog listing. For any suspected compromise, response should cover connected infrastructure as well as the gateway, including VMware ESXi hosts, and should follow the organization’s incident-response procedures.
Further updates may clarify the number of victims, the extent of any data destruction and whether investigators can attribute the operation. Until then, the confirmed picture is limited to Check Point’s observed incidents and its published account; the broader scope and responsible actor remain unsettled.
Key Questions
What happened in the Check Point gateway attacks?
Check Point says attackers used two PHP vulnerabilities to gain code execution through unpatched Mobile Access portals, then exploited a separate flaw to obtain root access. They planted a back door and, in some cases, moved to VMware ESXi servers and ran a wiper.
Did every compromised gateway suffer data destruction?
No. Check Point reported wiper activity in some incidents in the first wave targeting Israeli organizations. It said the second wave, which began November 2 and affected organizations across multiple countries, showed no evidence of destructive activity.
Which vulnerabilities were involved?
The initial access involved PHP2Shell, CVE-2026-109618 and CVE-2026-109619. The attackers then used CVE-2026-123039, a local privilege-escalation flaw in Check Point’s Gaia system, to reach root privileges.
What should Check Point customers do?
Install the applicable November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Check exposed systems against Check Point’s indicators of compromise and investigate connected infrastructure if compromise is suspected.
Who was responsible for the attacks?
Check Point has not attributed the operation with confidence. ESET has linked the back-door malware family to a China-nexus group, but that link does not establish who conducted these attacks.
Source: ThorstenMeyerAI.com
