🔍 Read the full analysis: Could A Check Point Gateway Exploit Lead To A Wiper Attack? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways from October 30 to November 4, using PHP flaws to gain access and a separate vulnerability for root privileges. In some incidents targeting Israeli organizations, they moved to VMware ESXi hosts and ran a wiper; a second wave showed no evidence of destructive activity. Check Point released fixes on November 12, and CISA added the root-access flaw to its exploited-vulnerability catalog on November 13.
Attackers compromised unpatched Check Point Security Gateways between October 30 and November 4, and in some incidents moved to VMware ESXi servers to run a data-wiping program, the company said in an investigation published November 12. Check Point says it found only a couple of dozen compromised systems in one region; it has not attributed the activity with confidence. CISA added the root-access vulnerability used in the attacks to its exploited-vulnerability catalog on November 13, giving U.S. federal agencies until November 16 to address it.
According to Check Point Research, attackers reached vulnerable gateways through the Mobile Access portal, exploiting two critical PHP vulnerabilities known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619. The flaws allowed unauthenticated remote code execution through affected web interfaces. The initial access provided code execution under the portal’s service account; attackers then used CVE-2026-123039 to gain root privileges on the appliance.
Check Point says the first observed wave targeted Israeli organizations. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6, which overwrites files with zeros and deletes them. The program left a file named DREAM_ANNEXATION.txt that, according to Check Point, rejects ransom negotiations. A second wave on November 2 affected organizations in multiple countries, but the company said it found no evidence of destructive activity in that wave.
Check Point says it released a hotfix for PHP2Shell on its gateways on October 23, before the observed attacks began. The separate root-access flaw was disclosed, with its fix, on November 12. The company advises installing its November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed appliances for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Risk From Gateway to ESXi
The incidents show how a flaw in an internet-facing gateway can become a route to other systems on an organization’s network. In the cases described by Check Point, attackers first gained access through a web portal, escalated privileges on the appliance, and in some instances reached VMware ESXi infrastructure. That makes the report relevant beyond organizations using Mobile Access: gateways are positioned to handle external connections and can provide a foothold from which intruders may seek to move elsewhere.
The wiper activity raises the potential for data loss and disruption, but the available account does not establish how much data was destroyed, whether it was recoverable, or the operational impact on affected organizations. Check Point’s finding of a couple of dozen compromised unpatched systems is limited to the incidents it investigated, not a count of all potentially exposed or targeted devices. CISA’s federal deadline adds urgency for U.S. agencies, while organizations outside the federal government should use the vendor’s advisory to assess their own exposure.
This is not evidence that every vulnerable gateway was compromised or that every intrusion led to destructive activity. The distinction between the first, Israel-focused wave and the later wave without observed destructive activity matters when interpreting the risk. The confirmed concern is that attackers used the vulnerabilities in real intrusions; the scale and wider consequences remain uncertain.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple MacBook Pro 14.2-inch with Tandem OLED Display, Space Black
Ledger Nano Gen5 Crypto Wallet, Black
As an affiliate, we earn on qualifying purchases.
How the Two Flaws Fit
PHP2Shell refers to two critical vulnerabilities in PHP. The PHP project released fixes on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA described the vulnerabilities as allowing unauthenticated remote code execution and added them to its Known Exploited Vulnerabilities catalog on October 26. The flaws can affect network appliances that include PHP in their own software, even when users do not manage PHP as a separate application. In those cases, device makers need to provide and distribute the relevant appliance update.
Check Point’s account describes a chain rather than a single vulnerability doing everything. PHP2Shell supplied initial code execution through the portal. The second issue, CVE-2026-123039, involved a Gaia operating-system helper service called DynamicCLI. Check Point says the service ran as root and accepted commands over a local socket without verifying the caller, but exploiting it required code execution on the appliance first. The November Jumbo Hotfix addresses the issues identified in the company’s advisory.
Check Point says the attacks it investigated began October 30, after its PHP2Shell hotfix was available, but before the root flaw was publicly disclosed and fixed. The company’s timeline therefore makes patch status and exposure important: an available update does not protect systems on which it was not installed. Check Point also says versions R81.10 and older are past end of support, so administrators should consult vendor guidance for supported remediation rather than assume those versions receive the same update.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Damage Remain Open
Who carried out the attacks remains unknown. Check Point says the evidence does not support a high-confidence assessment of the operation. The back door identified in the investigation belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity targeting Israel does not fit that group’s known interests. That connection is not proof that the group was responsible.
The investigation also does not establish the full number of affected organizations, the amount of data overwritten, whether affected systems were restored, or the impact on their operations. Check Point reported no evidence of destructive activity in the November 2 wave, but that finding is limited to the activity it examined. The source material does not provide a complete account of all attempts, nor does it confirm whether additional victims or attack methods have since been identified.
It is also not clear from the reported findings whether every compromised gateway had installed an earlier PHP2Shell update, or precisely how attackers selected targets. The observed attacks began after Check Point says its PHP2Shell gateway hotfix was available, while the root flaw was fixed later. Administrators should distinguish between a patch being published and a particular appliance actually having it installed.
Patch, Then Check Exposed Gateways
Check Point’s guidance is to install the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with internet-facing Mobile Access portals, and then inspect exposed devices for indicators listed in its advisory. The stated minimum hotfix takes include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Administrators should verify current vendor instructions and confirm the update is installed, rather than relying only on the release date.
CISA’s November 16 deadline applies to U.S. federal agencies under its catalog process. Other organizations should assess whether they operate affected gateways, whether those systems were exposed to the internet, and whether there are signs of compromise. Applying a patch addresses the known vulnerability but does not, by itself, determine whether a system was previously accessed; Check Point specifically recommends checking for its listed indicators.
Further clarity depends on additional incident findings from Check Point, affected organizations and security researchers. Updates to CISA’s catalog or vendor guidance may also change response priorities. Until more information is available, the confirmed facts remain that attackers exploited the gateway vulnerabilities, some investigated incidents included a wiper on ESXi systems, and the activity’s attribution and full impact have not been established.
Key Questions
What happened in the Check Point gateway attacks?
Check Point says attackers exploited PHP2Shell flaws through Mobile Access portals on unpatched Security Gateways, then used a separate vulnerability to gain root privileges. In some incidents, they moved to VMware ESXi servers and ran a wiper.
Did every attack include a wiper?
No. Check Point reported wiper activity in some incidents in the first wave targeting Israeli organizations. For a second wave on November 2 across multiple countries, it said it found no evidence of destructive activity.
Which updates does Check Point recommend?
Check Point advises installing its November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed appliances for the indicators in its advisory. It lists different minimum hotfix takes for supported software versions.
Who is responsible for the attacks?
That has not been established. Check Point says it cannot assess the operation’s nature with high confidence. A link between the back-door malware family and a China-nexus group is not enough to confirm that group carried out these attacks.
What is the CISA deadline?
CISA added CVE-2026-123039 to its catalog of exploited vulnerabilities on November 13 and set November 16 as the deadline for U.S. federal agencies to act. The deadline is specific to those agencies.
Source: ThorstenMeyerAI.com
