🔍 Read the full analysis: PHP2Shell Attacks On Check Point Gateways: A Patch Guide on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Check Point says attackers exploited unpatched Security Gateways from Oct. 30 through Nov. 4, using PHP2Shell flaws to gain initial access and a separate vulnerability to obtain root privileges. The company released fixes in its November Jumbo Hotfix; CISA added the root-access flaw to its exploited-vulnerabilities catalog and gave U.S. federal agencies until Nov. 16 to act.
Check Point says attackers breached unpatched Security Gateways between Oct. 30 and Nov. 4, using PHP2Shell vulnerabilities to get code running and a separate flaw to gain root access. The company published fixes in its November Jumbo Hotfix on Nov. 12, while the U.S. Cybersecurity and Infrastructure Security Agency added the root-access vulnerability, CVE-2026-123039, to its exploited-vulnerabilities catalog on Nov. 13.
Check Point’s investigation describes attacks against gateways whose Mobile Access portals were exposed and had not received the relevant PHP2Shell fix. The PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, provided a route to remote code execution. Attackers then used CVE-2026-123039, a separate vulnerability in the Gaia operating system, to elevate privileges to root. Check Point rates that flaw 7.8 out of 10 and says an attacker first needed local code execution on the appliance.
Check Point reported that only a couple of dozen unpatched systems in one region were compromised in the incidents it observed. In an initial wave targeting Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi server and ran a wiper called destroy_v6. The program overwrites files with zeros and deletes them. Its note, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to Check Point. A second wave on Nov. 2 targeted organizations in multiple countries; the company said it found no evidence of destructive activity in that wave.
The company recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, then checking exposed gateways for indicators in its advisory. The source lists minimum hotfix takes of Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Administrators should confirm the applicable release and instructions in Check Point’s advisory before deploying changes.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Can Lead to Network Damage
The incidents matter because an internet-facing security gateway is positioned between outside traffic and an organization’s internal network. According to Check Point’s account, attackers who got code execution on a gateway could use a second weakness to reach root-level control, establish persistence and, in some cases, proceed to an ESXi host. That sequence makes patching and investigation relevant beyond the gateway itself.
The reported destruction was limited to some cases in the first, Israel-focused wave; Check Point said it found no evidence of destructive activity in the later wave. The incidents therefore do not establish that every affected gateway led to data destruction. Still, organizations should treat an exposed, unpatched appliance as a possible entry point and review connected systems, while distinguishing observed compromise from attempted exploitation.
There is also a short-term compliance issue for U.S. federal agencies: CISA’s catalog entry sets Nov. 16 as the deadline to address CVE-2026-123039. Other organizations may not share that deadline, but the catalog listing signals that the flaw is being treated as exploited and calls for prompt attention.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Attack Chain
PHP2Shell refers here to two critical PHP vulnerabilities that can allow unauthenticated remote code execution. The PHP project issued fixes on Oct. 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added the PHP flaws to its Known Exploited Vulnerabilities catalog on Oct. 26. Check Point’s advisory says the flaws may allow remote code execution through firewall web interfaces.
For Check Point gateways, the PHP fixes and the root-access fix were separate steps. Check Point says its PHP2Shell hotfix was available on Oct. 23, before the observed attacks began. CVE-2026-123039 was disclosed and patched in the Nov. 12 Jumbo Hotfix. The vendor’s investigation says attackers used the PHP flaw to obtain limited code execution, then exploited a Gaia helper service to obtain root. Check Point described that service as running with root privileges and listening on a world-writable local socket without checking the caller.
Appliances can include PHP as part of their own software, so updating PHP itself may not patch a network device; the device vendor must provide an applicable update. Check Point lists R81.10 and older as past end of support. CISA separately warns that PHP versions 8.1 and earlier are unsupported and advises taking affected systems offline until they can be updated.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Scope Remain Open
Who carried out the attacks remains unknown. Check Point has not attributed them with confidence. The back door used in the incidents belongs to a malware family that ESET has linked to a China-nexus group, but the supplied reporting says the destructive, Israel-focused activity does not fit that group’s known interests. That association alone does not establish responsibility.
The company’s findings cover the incidents it investigated, not necessarily every attempted intrusion or compromised device. Its estimate of a couple of dozen compromised systems applies to unpatched systems in one region. The source material does not give a full count of targeted organizations, attempted attacks, or affected systems across all regions. It also does not establish whether other gateway versions or configurations were affected beyond those described in the advisory.
Check Point identified destructive activity in some cases in the first wave and reported no evidence of it in the second. That is a finding from its investigation, not proof that no unobserved destructive activity occurred. Organizations will need to compare their own gateway and server records against the vendor’s indicators to determine whether their environments were affected.
Patch, Then Check Exposed Gateways
Organizations using Check Point Management Servers or Security Gateways should consult the vendor’s Nov. 12 advisory, install the applicable November Jumbo Hotfix, and prioritize internet-facing Mobile Access portals. Administrators should verify the correct take for each software release, since the listed minimums differ by version. Systems on releases that have passed end of support, including R81.10 and older, need particular attention to supported remediation options.
After patching, security teams should review every gateway that was exposed for the indicators Check Point lists and investigate related activity on connected infrastructure, including VMware ESXi hosts where relevant. Applying a patch addresses the vulnerability but does not by itself establish whether a device was previously compromised. CISA’s deadline for U.S. federal agencies to act on CVE-2026-123039 is Nov. 16, 2026; further guidance or updated attribution may follow as investigations continue.
Key Questions
What is PHP2Shell in this incident?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Check Point says attackers reached them through unpatched gateways’ Mobile Access portals to run code on the appliances.
Which Check Point fix should administrators install?
Check Point says to install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Its source material lists minimum takes of Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Confirm the correct package and instructions in the vendor advisory.
Did the attacks destroy data?
Check Point says attackers ran a wiper against VMware ESXi hosts in some cases in the first wave, which targeted Israeli organizations. The company reported no evidence of destructive activity in the second wave. The available account does not establish that every compromised gateway suffered data destruction.
Who was behind the attacks?
Attribution is not confirmed. Check Point says its evidence does not support a high-confidence assessment of who carried out the operation. A link between the back-door malware family and a China-nexus group does not, on its own, identify the operators.
What is the federal deadline?
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on Nov. 13, 2026, and set Nov. 16 as the deadline for U.S. federal agencies to act. The deadline stated in the source applies to federal agencies.
Source: ThorstenMeyerAI.com
