🔍 Read the full analysis: PHP2Shell To Wiper: A Check Point Gateway Security Briefing on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell to gain access and a separate flaw to obtain root privileges. Some incidents included a wiper attack on VMware ESXi hosts; the company says a later wave showed no evidence of destructive activity. Check Point released fixes on November 12, and CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, using two PHP vulnerabilities to enter through Mobile Access portals and a separate flaw to gain root privileges. In some incidents, the attackers moved to VMware ESXi servers and ran a data-wiping program; Check Point says a second wave showed no evidence of destructive activity.
Check Point’s investigation says the first stage involved PHP2Shell, a name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Attackers used the vulnerabilities through internet-facing Mobile Access portals on gateways that had not received the relevant fix. The flaws allowed remote code execution, according to CISA. Attackers then used CVE-2026-123039, a separate vulnerability in the appliance’s Gaia operating system, to escalate from limited service-level access to root.
Check Point reported that the first wave targeted Israeli organizations. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6, which overwrites files with zeros before deleting them. The program left a file named DREAM_ANNEXATION.txt that, according to Check Point, explicitly rejected ransom negotiations. A second wave beginning November 2 targeted organizations in multiple countries, but Check Point said it found no evidence of destructive activity in those incidents.
The company said only “a couple of dozen” unpatched systems in one region were compromised in the incidents it observed. Check Point’s PHP2Shell hotfix had been available on October 23, before the attacks began, while the root flaw and its fix were disclosed on November 12. The company says the fixes are included in its November Jumbo Hotfix. It recommends installing that update on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for listed indicators of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Led to Data Destruction
The incidents show how a vulnerability in a network appliance can become an entry point to other systems. The attackers reportedly chained remote code execution with a privilege-escalation flaw: the first gave them a foothold on the gateway, and the second gave them root-level control. From there, some attackers reached VMware infrastructure and ran software intended to destroy data.
That sequence matters to organizations that rely on security gateways as a boundary between internal networks and the internet. A compromised gateway may provide a route beyond the appliance itself, so installing the fix is only one part of response. Administrators also need to review exposed systems for signs of persistence or lateral movement and assess whether connected servers were affected. The reported wiper activity was limited to some observed incidents; it should not be read as evidence that every targeted organization lost data.
The timing also highlights a patching gap between software components and network appliances. PHP’s fixes were released on October 21, but appliance customers depended on a vendor-provided gateway update. Check Point says its fix for the PHP flaws was available before the observed attacks, while the separate root-access issue was addressed in the November 12 Jumbo Hotfix. Both vulnerabilities and the affected appliance versions need attention, rather than treating the PHP update alone as a complete remedy.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
DJI Osmo 360 Motorcycle Handlebar POV Combo
Samsung 37-inch Odyssey G7 4K UHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Two Flaws, Separate Fix Timelines
PHP2Shell refers to two critical flaws in PHP, a programming language embedded in many websites and products. The PHP project released fixes on October 21 for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution. It added both to its Known Exploited Vulnerabilities catalog on October 26 and warned that PHP may be bundled inside other products, making its presence difficult to identify directly.
In Check Point’s account, the PHP vulnerabilities provided access to the gateway but did not by themselves explain how attackers obtained full control. The second step used CVE-2026-123039, which Check Point rated 7.8 out of 10, or high severity. The flaw involved a Gaia helper service called DynamicCLI. Check Point says the service ran as root and accepted commands over a local socket without checking the caller, allowing a process already running on the appliance to execute commands with root privileges.
Check Point’s published remediation guidance names minimum Jumbo Hotfix takes: Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says R81.10 and older versions are past end of support. CISA gave U.S. federal agencies until November 16 to address CVE-2026-123039 after adding it to its catalog on November 13.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Wider Impact Remain Open
Check Point has not attributed the operation with confidence. It says the back door belongs to a malware family that ESET has linked to a China-nexus group, but the destructive activity focused on Israel does not fit that group’s known interests. That mismatch is a reason for caution, not proof of who carried out the attacks. The responsible actor remains unidentified in the available account.
The reported scope is also bounded by what Check Point observed: a couple of dozen compromised unpatched systems in one region. The available information does not establish how many organizations were targeted overall, whether other victims have not yet been identified, or the full amount of data destroyed. Check Point reported no evidence of destructive activity in the second wave, but that finding does not establish that every system targeted in those countries was unaffected.
The source material describes the attackers’ use of web shells and a back door, but does not provide a complete incident-by-incident account of persistence, data loss or recovery. Organizations will need to compare their own gateway and server records with Check Point’s indicators and determine whether any affected systems were reached. Installing the hotfix does not by itself establish that a previously compromised device is clean.
Patch, Inspect and Report Findings
Check Point customers should install the November Jumbo Hotfix on Management Servers and Security Gateways, beginning with internet-facing Mobile Access portals, using the minimum takes listed for their versions. They should then inspect exposed gateways for the indicators in Check Point’s advisory and review connected VMware ESXi systems for evidence of unauthorized access or destructive activity. Systems running R81.10 or older are past end of support, so administrators should consult the vendor’s current support and upgrade guidance rather than assume the listed supported-version hotfixes apply.
U.S. federal agencies faced a CISA deadline of November 16, 2026, to address CVE-2026-123039. The source material does not state whether agencies had completed remediation by that date. Further clarity may come from additional vendor updates, agency notices or investigations by affected organizations. Until then, the known facts are the attack window reported by Check Point, the two-stage access path, the limited number of observed compromised systems and the presence of wiper activity in some first-wave incidents.
Key Questions
What happened to the Check Point gateways?
Check Point says attackers entered unpatched Security Gateways through Mobile Access portals using two PHP vulnerabilities, then exploited CVE-2026-123039 to obtain root privileges. Some attackers installed a back door and, in certain incidents, moved to VMware ESXi servers.
Did the attacks destroy data?
In some first-wave incidents, Check Point says attackers ran destroy_v6, a wiper that overwrites files with zeros and then deletes them. The company reported no evidence of destructive activity in the second wave. The extent of data loss is not established in the available information.
Which updates should administrators install?
Check Point recommends its November Jumbo Hotfix for Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Minimum takes listed by the company are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
Who was behind the operation?
Check Point has not attributed the attacks with confidence. It says the back door is associated with a malware family ESET has linked to a China-nexus group, but the observed targeting and destructive activity do not fit that group’s known interests.
Source: ThorstenMeyerAI.com
