🔍 Read the full analysis: A Patch Checklist For Check Point Gateways Targeted By Attackers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell flaws and a separate vulnerability to gain root access. The company’s November Jumbo Hotfix addresses the root-access flaw, and CISA has ordered US federal agencies to act by November 16. Check Point recommends installing the hotfix on Management Servers and Gateways, then checking exposed systems for signs of compromise.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, using vulnerabilities in the Mobile Access portal and a separate flaw to gain root access. The company published a fix in its November Jumbo Hotfix; on November 13, the US Cybersecurity and Infrastructure Security Agency (CISA) listed the root-access flaw, CVE-2026-123039, as exploited and set a November 16 deadline for federal agencies to address it.
Check Point’s November 12 investigation says the intrusions began with PHP2Shell, a name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Attackers reached them through the gateways’ Mobile Access portal on systems that had not installed the relevant fix. The PHP flaws allowed unauthenticated remote code execution, according to CISA. Check Point says a separate vulnerability, CVE-2026-123039, then let attackers elevate their access to root, the appliance’s highest-privilege account.
Check Point says it observed compromises on “only a couple of dozen unpatched systems, in a single region.” In a first wave targeting Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi server and ran a destructive program called destroy_v6. The company says the program overwrote files with zeros and then deleted them. A note left behind, DREAM_ANNEXATION.txt, “explicitly rejects ransom negotiations,” according to Check Point’s account.
A second wave on November 2 targeted organizations in multiple countries. Check Point reported no evidence of destructive activity in that wave. The vendor says its PHP2Shell hotfix for gateways was available on October 23, before the observed attacks began. The root-access vulnerability was disclosed, and its fix released, on November 12. Check Point advises installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Patch Exposure Before Investigating
The attacks show how a flaw in a web-facing gateway can become a route to broader access inside an organization. Check Point says attackers first obtained code execution through Mobile Access, then used a second weakness to become root. That sequence matters because a perimeter appliance may be connected to other systems, as the reported moves to VMware ESXi hosts illustrate.
Installing the hotfix addresses the identified vulnerability, but organizations should not assume patching alone removes access already established. Check Point describes web shells and a back door designed to persist through a restart. Administrators should therefore patch and inspect exposed systems, following the indicators in the vendor’s investigation and advisory. The reported wiper activity also makes checking the integrity and availability of data and backups relevant for affected organizations.
CISA’s November 16 deadline applies to US federal agencies, not all organizations. The agency’s catalog listing nonetheless signals that the root-access flaw is being treated as actively exploited. Other operators of affected gateways should consult Check Point’s advisory and prioritize internet-facing systems.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
PHP2Shell refers to two critical flaws in PHP, a programming language used in web applications and embedded in some network appliances. The PHP project issued corrected versions on October 21: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added the PHP flaws to its Known Exploited Vulnerabilities catalog on October 26. Check Point’s advisory says the flaws could allow remote code execution through firewall web interfaces.
Appliance customers generally depend on the manufacturer to integrate software fixes into a supported device update. Check Point says its gateway hotfix for PHP2Shell was available on October 23, but the later root-access issue required a separate update. The company’s November Jumbo Hotfix includes the fix for CVE-2026-123039.
Check Point identifies the affected minimum hotfix takes as Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82, and Take 174 on R81.20. The vendor says R81.10 and older releases are past end of support. Organizations using those versions should check Check Point’s supported upgrade guidance rather than assume an update for a supported release applies to them.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point, describing the systems compromised in observed incidents
Attribution and Scope Remain Open
Who carried out the attacks remains unconfirmed. The back door is part of a malware family that ESET has linked to a China-nexus group, but the supplied reporting says the destructive activity focused on Israeli organizations does not fit that group’s known interests. Check Point says the available evidence is not sufficient for a high-confidence assessment. A malware-family link by itself does not establish who operated it in these incidents.
Check Point’s “couple of dozen” figure describes the unpatched systems it observed in one region. The available information does not establish whether additional compromises went undetected or whether other customers were affected. The reported absence of destructive activity in the November 2 wave likewise does not establish that no systems in that wave were compromised.
The source material does not provide a complete account of customer notifications, recovery outcomes, or the number of organizations affected. It also does not specify whether every compromised gateway was recovered or whether the back door was removed in all cases. These questions require further technical findings or disclosures from the vendor and affected organizations.
Install the Hotfix, Then Check
Administrators should install the November Jumbo Hotfix on Check Point Management Servers and Security Gateways, starting with internet-facing Mobile Access portals. Check Point lists minimum takes of R82.20 Take 14, R82.10 Take 52, R82 Take 132, and R81.20 Take 174. Operators should verify the applicable release and installation instructions in the vendor advisory, particularly for systems on unsupported versions.
After patching, organizations should check every exposed gateway for the compromise indicators listed by Check Point, including signs of web shells or the described back door. CISA’s deadline for US federal agencies to act on CVE-2026-123039 is November 16, 2026. Further updates may clarify the incident’s reach, attribution and recovery status; until then, Check Point’s published findings describe only the activity it investigated.
Key Questions
Which Check Point systems should administrators patch?
Check Point recommends the November Jumbo Hotfix for all Management Servers and Security Gateways, with internet-facing Mobile Access portals first. The listed minimum takes are R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174.
Does installing the hotfix prove a gateway was not compromised?
No. The update addresses the vulnerabilities, but Check Point says attackers placed web shells and a back door on compromised systems. The company recommends checking exposed gateways for its listed indicators of compromise as well as patching them.
What did the attackers do after gaining access?
Check Point says attackers used a second flaw to gain root access and established ways to run commands through the Mobile Access portal. In some incidents in the first wave, they moved to a VMware ESXi host and ran a wiper called destroy_v6. The vendor reported no evidence of destructive activity in the November 2 wave.
Who was responsible for the attacks?
Check Point has not attributed the operation with confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, but that association does not establish who conducted these attacks.
Who has a November 16 deadline?
CISA set the November 16, 2026 deadline for US federal agencies after adding CVE-2026-123039 to its catalog of exploited vulnerabilities. The source does not describe that deadline as applying to all Check Point customers.
Source: ThorstenMeyerAI.com
