🔍 Read the full analysis: Check Point Gateway Patch Priorities After PHP2Shell Activity on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says intruders compromised a small number of unpatched Security Gateways between October 30 and November 4, using PHP2Shell flaws and a separate vulnerability to gain root access. The company says some victims in an Israel-focused wave suffered destructive activity, while a later wave showed no evidence of destruction. Check Point advises installing its November Jumbo Hotfix and inspecting exposed gateways for signs of compromise.
Check Point says attackers compromised unpatched Security Gateways from October 30 to November 4 by exploiting PHP2Shell vulnerabilities through the Mobile Access portal, then using a separate flaw to gain root access. The company published fixes on November 12, and the U.S. Cybersecurity and Infrastructure Security Agency added the root-access vulnerability, CVE-2026-123039, to its exploited-vulnerability catalog on November 13, giving federal agencies until November 16 to act.
According to Check Point’s November 12 investigation, the attackers first exploited two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, through exposed Mobile Access portals on gateways that had not received the available PHP2Shell hotfix. The intruders then used CVE-2026-123039, a flaw in the gateway’s Gaia operating system, to escalate from code execution under a limited service account to root-level access. Check Point says the root flaw required an attacker to already have local code execution on the appliance.
The company reported two waves of activity. The first targeted Israeli organizations; in some cases, attackers moved from a gateway to a VMware ESXi server and ran a wiper called destroy_v6, which Check Point says overwrites files with zeros before deleting them. A note left by the wiper, DREAM_ANNEXATION.txt, rejected ransom negotiations. A second wave on November 2 targeted organizations in multiple countries, but Check Point said it found no evidence of destructive activity in those incidents.
Check Point said only “a couple of dozen unpatched systems, in a single region” were compromised in the incidents it observed. That is the vendor’s account of the investigated cases, not a count of every potentially exposed system. It recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed appliances for the compromise indicators in its advisory.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Patches Matter
A compromised security gateway can provide an attacker with a route into an organization’s network, and root access gives the intruder broad control over the appliance. In the incidents Check Point described, access did not stop at the gateway: attackers reached an ESXi server in some cases and launched destructive software. That makes the advisory relevant not only to organizations using Mobile Access, but also to teams responsible for virtualization infrastructure and incident response.
The timing also highlights two separate patch issues. Check Point says its fix for the PHP2Shell route on its gateways was available on October 23, before the observed attacks began. The separate root-access flaw was disclosed and fixed in the November 12 Jumbo Hotfix. Applying the PHP fix alone would not address the later privilege-escalation vulnerability, according to the vendor’s account; customers need the specified Jumbo Hotfix and should investigate previously exposed systems.
CISA’s November 13 catalog addition puts CVE-2026-123039 on a federal remediation schedule, with U.S. agencies directed to act by November 16. The deadline applies to federal agencies; the source material does not state that it is a deadline for all organizations. For other customers, Check Point’s patching and investigation guidance remains the direct vendor recommendation.
Popular right now
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
How the Two Flaws Combined
PHP2Shell refers to two critical flaws in PHP that can allow unauthenticated remote code execution. The PHP project released fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added the PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26. Because appliances can include PHP as part of their own software, customers generally depend on the device maker to provide and distribute an appliance-specific fix.
On Check Point gateways, the reported chain began through the Mobile Access web interface. Check Point says the PHP flaws gave attackers code execution as the portal service account. They then exploited CVE-2026-123039 in a Gaia helper service, DynamicCLI, to obtain root privileges. The vendor describes the flaw as a high-severity vulnerability rated 7.8 out of 10, and says it could be used only after an attacker had already obtained local code execution on the appliance.
Check Point’s advisory lists minimum Jumbo Hotfix levels: Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The source material says R81.10 and older versions are past end of support. Customers should use Check Point’s advisory to confirm the applicable update and indicators for their particular deployment.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Still Open
Check Point has not attributed the operation with confidence. The back door used in the activity belongs to a malware family that ESET has linked to a China-nexus group, according to the source material, but the reported destructive activity against Israeli organizations does not fit that group’s known interests. That association is not proof that the group carried out these attacks, and Check Point says the available evidence is insufficient for a confident assessment.
The full scale of exposure is also not established. Check Point reported a couple of dozen compromised unpatched systems in a single region among the incidents it observed, but the source material does not give a complete count of scanned, targeted or otherwise vulnerable gateways. It also does not provide a full account of whether every compromised organization experienced the same stages of intrusion. The second wave had no evidence of destructive activity, according to Check Point; that does not establish that every affected system was free of other unauthorized access.
Apply Fixes and Check Gateways
Organizations using Check Point Security Gateways should install the applicable November Jumbo Hotfix on Management Servers and gateways, with internet-facing Mobile Access portals first, and confirm the installed take meets the vendor’s stated minimum. They should then review every exposed gateway against Check Point’s listed indicators of compromise, including systems that have since been patched. Patching addresses the vulnerability, but it does not by itself determine whether an appliance was compromised earlier.
U.S. federal agencies face the CISA deadline of November 16 for CVE-2026-123039. Other organizations should follow Check Point’s advisory and their own incident-response procedures. Check Point says versions R81.10 and older are past end of support, so administrators running them should consult the vendor’s support and upgrade guidance rather than assume they will receive the same fix path as supported releases.
Further clarity depends on investigation findings, including whether Check Point or other researchers can establish the operation’s scope and attribution. Until then, the confirmed response is to patch the affected gateway software, inspect exposed appliances, and treat any signs of root-level access or movement to virtualization hosts as an incident requiring investigation.
Key Questions
What happened to Check Point Security Gateways?
Check Point says attackers used PHP2Shell flaws through unpatched Mobile Access portals from October 30 to November 4, then exploited CVE-2026-123039 to gain root access on some appliances.
Which fix should Check Point customers install?
Check Point recommends its November Jumbo Hotfix for Management Servers and Security Gateways. The minimum takes listed in the source are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20; customers should confirm their version against the vendor advisory.
Did the attacks destroy data?
Check Point says some incidents in the first wave against Israeli organizations involved a wiper on a VMware ESXi server. It reported no evidence of destructive activity in a second wave on November 2, which targeted organizations across multiple countries.
Who was responsible for the attacks?
The actor has not been confidently identified. A malware-family link to a China-nexus group has been reported, but Check Point says the evidence does not support a high-confidence attribution.
What should administrators do after patching?
Check exposed gateways for the compromise indicators in Check Point’s advisory. Installing a fix does not establish whether an appliance was compromised before it was patched.
Source: ThorstenMeyerAI.com
