🔍 Read the full analysis: From Gateway Exploit To Wiper: Patching Check Point Systems on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways between October 30 and November 4, using PHP flaws and a second vulnerability to gain root access. Some incidents involved a wiper on VMware ESXi servers; the company has not attributed the operation with confidence. CISA added the root-access flaw to its exploited-vulnerabilities catalog and directed US federal agencies to act by November 16.
Check Point says attackers compromised a couple of dozen unpatched Security Gateways in a single region between October 30 and November 4, using two PHP vulnerabilities to get in and a separate flaw to gain root access. In some incidents, the attackers moved from a gateway to a VMware ESXi server and ran a data-wiping program; the company has not attributed the operation with confidence. CISA added the root-access vulnerability, CVE-2026-123039, to its exploited-vulnerabilities catalog on November 13 and set a November 16 deadline for US federal agencies to address it.
Check Point’s November 12 investigation describes a chain that began at internet-facing Mobile Access portals on gateways without the relevant PHP2Shell fix. The term refers to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which the PHP project fixed on October 21. Check Point says the attackers used them to run code as the portal’s service account, then exploited CVE-2026-123039 to obtain root privileges on the appliance.
With root access, the attackers installed web shells and a back door, according to Check Point. In the first wave, which the company says targeted Israeli organizations, some intrusions continued to VMware ESXi hosts and launched a wiper called destroy_v6. The program overwrote files with zeros and deleted them. A note left by the wiper, DREAM_ANNEXATION.txt, rejected ransom negotiations, Check Point said. A second wave on November 2 targeted organizations in multiple countries; Check Point reported no evidence of destructive activity in those incidents.
Check Point says a hotfix for the PHP2Shell flaws on its gateways was available on October 23, before the observed attacks began. The fix for the separate root-access vulnerability was included in the November Jumbo Hotfix, disclosed November 12. The vendor recommends installing that update on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for indicators of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Can Reach ESXi
The incidents show how a compromise of a network gateway can become a threat to other systems behind it. Here, attackers reportedly used one vulnerability to execute code through a web-facing portal and another to gain full administrative control of the appliance. In some cases, that access was followed by movement to an ESXi host, where a wiper could disrupt or destroy data.
The reported scale is limited to the incidents Check Point observed: the company said a couple of dozen unpatched systems in one region were compromised. That figure does not establish how many systems were exposed, whether other victims were missed, or how many organizations experienced destructive activity. Still, CISA’s listing and federal deadline make the flaw a time-sensitive concern for agencies, while other operators of affected gateways face the need to patch and investigate their own systems.
Popular right now
TCL 55-Inch T7 Series 4K QLED Smart Google TV (55T7)
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
As an affiliate, we earn on qualifying purchases.
Two Flaws, Different Fix Timelines
The PHP2Shell flaws affect PHP, a programming language used in websites and embedded in some network appliances. CISA describes the vulnerabilities as allowing unauthenticated remote code execution. It added both PHP flaws to its Known Exploited Vulnerabilities catalog on October 26. Because PHP can be bundled inside other products, updating PHP itself may not update an appliance; customers generally need the device maker’s fix.
In Check Point’s account, PHP2Shell provided the initial code execution, but it did not by itself give the attacker root privileges. That step depended on CVE-2026-123039, which Check Point rated high severity at 7.8 out of 10 and said required an attacker to already have local code execution. The vendor’s November Jumbo Hotfix addresses the root-access flaw as well as the recommended gateway remediation. Check Point listed minimum update takes including R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174; administrators should confirm the applicable package and instructions for their deployment.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Full Impact Remain Open
Who carried out the operation remains unknown. Check Point said it could not assess the activity’s nature with high confidence. The back door is associated with a malware family that ESET has linked to a China-nexus group, according to the source material, but the reported destructive activity and focus on Israel do not fit that group’s known interests. That association alone does not establish who was responsible.
The available account also leaves the full scope uncertain. Check Point’s figure covers the compromises it observed, while the company has not established how many gateways were vulnerable or exposed, whether other organizations were affected, or how many systems were reached beyond the gateways. Its report describes destructive activity in some first-wave cases, but does not report wiper activity in the November 2 wave. The number of affected ESXi hosts and the extent of any data loss have not been provided here.
Patch, Then Check Exposed Gateways
Administrators should install Check Point’s November Jumbo Hotfix on Management Servers and Security Gateways, giving internet-facing Mobile Access portals priority, and use the vendor’s guidance to identify the correct update take. Check Point also advises checking every exposed gateway for the indicators listed in its investigation; applying a patch does not by itself determine whether a system was compromised earlier.
CISA’s November 13 listing gives US federal agencies until November 16 to address CVE-2026-123039 under the agency’s required remediation process. The immediate next developments are likely to include further incident response and any additional disclosure from Check Point or government agencies. The available source material does not specify whether Check Point plans another update or whether investigators have reached an attribution finding.
Key Questions
What happened to Check Point Security Gateways?
Check Point says attackers used two PHP2Shell flaws to execute code through unpatched Mobile Access portals, then exploited CVE-2026-123039 to gain root access. They installed a back door, and in some cases moved to VMware ESXi hosts and ran a wiper.
Which update should administrators install?
Check Point recommends its November Jumbo Hotfix for all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The minimum update takes named in its guidance include R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174.
Did every incident involve data destruction?
No. Check Point reported wiper activity in some incidents during a first wave targeting Israeli organizations. It said it found no evidence of destructive activity in a second wave on November 2.
Who was behind the attacks?
That has not been established. Check Point said the evidence did not allow it to assess the operation with high confidence. A malware-family association cited in the reporting is not enough to confirm an actor.
What is the deadline for US federal agencies?
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on November 13, 2026, and gave US federal agencies until November 16 to act.
Source: ThorstenMeyerAI.com
