🔍 Read the full analysis: Understanding The Check Point Gateway Attack Path And Patch Needs on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways between October 30 and November 4, first using PHP2Shell flaws through Mobile Access portals and then a separate flaw to gain root access. The company released fixes in its November Jumbo Hotfix; CISA added the root-access vulnerability to its exploited-flaws catalog and gave U.S. federal agencies until November 16 to act. The attacker’s identity and the full scope of compromise remain uncertain.
Check Point’s November 12 investigation says the intrusion began with PHP2Shell, a name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Attackers reached the flaws through exposed Mobile Access portals on gateways that had not received the relevant fix, allowing remote code execution under the portal’s service account.
They then used CVE-2026-123039 to escalate privileges to root, the appliance’s highest-level account. Check Point describes the flaw in a Gaia operating-system helper service called DynamicCLI. The vendor rates it 7.8 out of 10, high severity, and says exploitation requires code execution on the appliance first. Check Point’s account says the intruders placed web shells and a back door designed to persist after a restart.
The activity had two reported phases. The first targeted Israeli organizations; in some cases, attackers moved from a gateway to a VMware ESXi host and ran a data-wiping program called destroy_v6. A second wave on November 2 targeted organizations in multiple countries, with Check Point reporting no evidence of destructive activity in those incidents. The company said only a couple of dozen unpatched systems in one region were compromised in the incidents it observed.
Check Point says its fix for the PHP2Shell vulnerabilities on its gateways was available October 23, before the reported attacks began. The separate root-access flaw was disclosed with its fix on November 12. The company advises installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed devices for the indicators in its advisory. The stated minimum takes include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Became Network Access
A gateway sits at a network boundary, handling access to company systems. In this incident, attackers who reached an exposed portal were able to progress from limited code execution to root privileges, then establish a way to return to the appliance. That progression makes patching and investigation both necessary: fixing the software addresses the vulnerability, but does not by itself establish whether an already exposed device was compromised.
The reported ESXi activity raises the potential impact beyond the gateway. Check Point says a wiper was used in some incidents, and that its default behavior overwrites files with zeros before deleting them. The note left by the program, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to the source material. The company reported no evidence of destructive activity in the November 2 wave, so the destructive behavior should not be assumed for every affected organization.
The incident also illustrates a patching complication for network appliances: PHP can be embedded in a vendor’s product, and users typically need the appliance maker’s update rather than a standalone PHP package. Administrators should apply the vendor hotfix, review the affected systems, and follow Check Point’s compromise checks rather than treating installation alone as proof that an earlier intrusion did not occur.
Products Worth Considering
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
LG UltraGear 34-inch Curved OLED Gaming Monitor, WQHD 1440p, 240Hz, 0.03ms, 800R
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Attack
The PHP project fixed the two PHP2Shell vulnerabilities on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both have a CVSS score of 9.2 and are rated critical. CISA describes them as enabling unauthenticated remote code execution in PHP. It added the flaws to its Known Exploited Vulnerabilities catalog on October 26.
Those PHP fixes did not, on their own, install updates on Check Point appliances. Check Point said its gateway hotfix for PHP2Shell was available October 23. The later root-access vulnerability was a separate issue: it allowed an attacker who already had local code execution to raise privileges on the appliance. The November Jumbo Hotfix addresses that flaw, according to the vendor.
Check Point says versions R81.10 and older are past end of support. Administrators using those releases should consult the vendor’s support guidance for an upgrade path; the source material does not provide a supported hotfix take for those versions.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution And Scope Remain Open
Check Point has not attributed the attacks with confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, according to the source material, but the reported destructive activity focused on Israeli organizations does not fit that group’s known interests. That mismatch is not proof of who carried out the operation, and Check Point says the available evidence is insufficient for a confident assessment.
The confirmed victim count is also limited to what Check Point observed: a couple of dozen unpatched systems in one region. The source material does not establish how many organizations were targeted, whether additional systems were compromised outside the observed incidents, or whether every exposed gateway was affected. It also does not specify the number of systems that suffered data loss or the complete impact of the reported ESXi activity.
The attack account and scope are based on Check Point’s investigation. Further independent confirmation of the incidents, attribution and effects was not included in the supplied material. Organizations must determine from their own logs and forensic checks whether their devices were accessed.
Patch, Then Check Exposed Gateways
Administrators should install the November Jumbo Hotfix on all Check Point Management Servers and Security Gateways, starting with internet-facing Mobile Access portals. They should confirm the installed release and take against the vendor’s advisory and review every gateway that was exposed for the listed indicators of compromise. A patched device may still require investigation if it was vulnerable during the attack window.
U.S. federal agencies face a separate deadline: CISA’s November 13 catalog entry gives them until November 16 to act on CVE-2026-123039. CISA’s action does not itself set a deadline for every private organization, but it underscores the agency’s assessment that the flaw is being exploited.
The next indicators to watch are additional findings from Check Point or CISA, updates to the vendor’s advisory, and evidence from affected organizations about compromise or damage. The campaign’s attribution and its full reach remain unresolved in the information available as of November 13, 2026.
Key Questions
Which Check Point products are affected?
The reported attacks targeted Check Point Security Gateways through their Mobile Access portals. Check Point advises installing the November Jumbo Hotfix on all Management Servers and Security Gateways, with internet-facing portals first. Follow the vendor advisory for the applicable release and take.
What vulnerabilities were used?
Check Point says attackers first used the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, for remote code execution through Mobile Access. They then used CVE-2026-123039 to gain root access on the appliance.
Does installing the hotfix prove a gateway was not compromised?
No. Installing the fix addresses the vulnerabilities, but it does not determine whether attackers accessed a device before it was patched. Check Point advises checking exposed gateways for the indicators listed in its advisory.
Did every victim suffer data destruction?
No. Check Point reported destructive activity in some cases during the first wave, including use of a wiper against VMware ESXi hosts. It said the November 2 wave showed no evidence of destructive activity.
Who carried out the attacks?
The actor has not been identified with confidence. Check Point said the evidence did not allow it to assess the operation’s nature with high confidence; a possible link between the back-door family and a China-nexus group does not establish attribution.
Source: ThorstenMeyerAI.com
