🔍 Read the full analysis: What To Know About PHP2Shell, Wipers, And Check Point Patches on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways between October 30 and November 4, using PHP2Shell flaws to gain access and a separate vulnerability to obtain root privileges. Some incidents involved a wiper on VMware ESXi servers; Check Point’s November Jumbo Hotfix addresses the flaws, and CISA set a November 16 remediation deadline for US federal agencies.
Check Point says attackers compromised a couple of dozen unpatched Security Gateways in a single region between October 30 and November 4, using PHP vulnerabilities to enter and a separate flaw to gain root access. In some incidents, the attackers moved from gateways to VMware ESXi servers and ran a data-destroying wiper; Check Point released fixes in its November Jumbo Hotfix, and the US Cybersecurity and Infrastructure Security Agency added the root-access flaw to its exploited-vulnerabilities catalog on November 13.
Check Point’s November 12 investigation describes an attack chain involving three vulnerabilities. Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, exposed unpatched gateways through their Mobile Access portals. After gaining limited code execution, attackers used CVE-2026-123039 to obtain root privileges on the appliance. Check Point says it has not confidently attributed the operation to a particular actor.
Check Point reported two waves of activity. The first targeted Israeli organizations; in some cases, attackers moved to a VMware ESXi host and ran a wiper named destroy_v6. The program overwrites files with zeros before deleting them. Its note, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations, according to Check Point. A second wave on November 2 targeted organizations in multiple countries, but the company said it found no evidence of destructive activity in that wave.
Check Point says a PHP2Shell hotfix for its gateways had been available from October 23, before the observed attacks began. The separate root-access flaw was disclosed, and its fix included in the November Jumbo Hotfix, on November 12. The vendor recommends installing the hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Led to Root Control
The incidents show how a flaw reachable through a network device’s web portal can become a route to administrator-level control when paired with a second vulnerability. Check Point says the initial PHP flaws gave attackers code execution as the portal’s service account; CVE-2026-123039 then let them execute commands as root. That sequence raises the stakes beyond access to a login interface: attackers may be able to establish persistence or affect systems reachable from the gateway.
The reported wiper activity also distinguishes some of the first-wave incidents from ordinary credential theft or extortion. Check Point says the malware destroyed files on certain ESXi hosts and left a note rejecting ransom talks. The company has not said how many organizations experienced destructive activity, and it reports no such evidence in the second wave. The findings are a reason for affected operators to apply the fixes and investigate exposed appliances, not evidence that all Check Point customers were breached.
For public-sector teams, the timing is immediate: CISA’s November 16 deadline applies to US federal agencies for the root-access flaw. Other organizations should follow vendor guidance and their own security procedures, with internet-facing portals receiving priority.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Apple Watch Series 12 GPS 42mm
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
As an affiliate, we earn on qualifying purchases.
Three Flaws, Two Patch Timelines
PHP2Shell refers to two critical vulnerabilities in PHP that allow unauthenticated remote code execution, according to CISA. The PHP project fixed them on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added both to its Known Exploited Vulnerabilities catalog on October 26. Because PHP can be embedded in other products, updating PHP itself may not update an appliance; customers often need the device maker’s patch.
That distinction shaped the Check Point timeline. The vendor says its gateway hotfix for the PHP flaws was available on October 23, but the attacks it investigated began on October 30. The root-access vulnerability was a separate issue, which Check Point disclosed and patched on November 12. Its advisory identifies the relevant minimum hotfix takes as Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point says R81.10 and earlier versions are past end of support.
Check Point’s report says attackers exploited the Mobile Access portal, then used the Gaia operating system’s DynamicCLI helper service to elevate privileges. The company describes that service as running as root and listening on a world-writable local socket without checking the identity of the caller. Its assessment rates the flaw 7.8 out of 10 and says exploitation requires local code execution on the appliance—access the PHP flaws could provide.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Damage Remain Unclear
Who was responsible remains unconfirmed. Check Point says the evidence does not support a high-confidence assessment of the operation. The back door is associated with a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity against Israeli organizations does not fit that group’s known interests. That association alone does not establish who conducted these attacks.
The public account also leaves open the full impact. Check Point reported a couple of dozen compromised unpatched systems in a single region, but has not provided a count of organizations affected by the wiper or the amount of data destroyed. Its report describes destructive activity in some first-wave incidents and no evidence of it in the second wave. The available information does not establish whether attackers accessed or removed data before running the wiper, or whether every compromised gateway has been identified.
It is also not clear from the source material how many potentially vulnerable gateways remain exposed or how quickly customers have installed the patches. Check Point’s observed incidents are bounded by its investigation and should not be treated as a complete measure of all attempted exploitation.
Patch, Then Check Exposed Gateways
Organizations using Check Point Security Gateways should install the November Jumbo Hotfix on Management Servers and gateways, giving internet-facing Mobile Access portals priority. They should confirm that their installed release meets the vendor’s stated minimum take, including Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 or Take 174 on R81.20. Operators on R81.10 or older should consult Check Point because those versions are past end of support.
After patching, administrators should review every gateway that was exposed using the indicators and investigation guidance in Check Point’s advisory, and assess connected systems, including ESXi hosts, where appropriate. A patch prevents the affected vulnerabilities from being used in the same way going forward; it does not by itself establish whether an attacker previously gained access or remove a back door that may already be present.
US federal agencies are subject to CISA’s November 16 deadline for addressing CVE-2026-123039. Further public reporting from Check Point, CISA or affected organizations may clarify the number of impacted systems, the extent of destruction and the operation’s attribution.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. CISA says they can allow unauthenticated remote code execution. In the incidents described by Check Point, attackers reached vulnerable gateway software through the Mobile Access portal.
Which Check Point flaw let attackers become root?
CVE-2026-123039 is the separate root-access flaw in Check Point’s Gaia operating system. Check Point says attackers used it after obtaining local code execution through the PHP vulnerabilities.
Did every affected organization experience data destruction?
No. Check Point says the wiper was run on some VMware ESXi hosts in the first wave targeting Israeli organizations. The company reported no evidence of destructive activity in a second wave on November 2.
What should Check Point customers do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Then review exposed gateways for the compromise indicators in Check Point’s advisory. The vendor says R81.10 and older versions are past end of support.
Has Check Point identified the attackers?
No confident attribution has been made. Check Point says the available evidence is insufficient to determine the operation’s true nature with high confidence. A reported link between the back-door malware family and a China-nexus group does not confirm that group carried out these attacks.
Source: ThorstenMeyerAI.com
