🔍 Read the full analysis: The Check Point Gateway Attack Story And What To Patch on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways between Oct. 30 and Nov. 4, using PHP flaws to gain access and a separate vulnerability to reach root. Its November Jumbo Hotfix addresses the root-access flaw; administrators should install it on Management Servers and Gateways, prioritizing internet-facing Mobile Access portals, and check exposed systems for compromise. The attackers’ identity remains undetermined.
Check Point says attackers compromised unpatched Security Gateways between Oct. 30 and Nov. 4, using two PHP vulnerabilities to enter through Mobile Access portals and a separate flaw to gain root access. The company published its investigation and a fix on Nov. 12; on Nov. 13, the U.S. Cybersecurity and Infrastructure Security Agency added the root-access vulnerability, CVE-2026-123039, to its exploited-vulnerabilities catalog and set a Nov. 16 action deadline for federal agencies.
Check Point’s Nov. 12 account says the attackers first exploited PHP2Shell, a name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. The flaws could allow unauthenticated remote code execution, according to CISA. On a vulnerable gateway, the initial access gave the intruders code execution as the Mobile Access portal’s service account. They then exploited CVE-2026-123039 to obtain root privileges on the appliance.
The company says it observed only a couple of dozen unpatched systems in a single region being compromised. In a first wave targeting Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6. Check Point says the program overwrites files with zeros before deleting them. Its note, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations. A second wave on Nov. 2 targeted organizations in multiple countries, with Check Point reporting no evidence of destructive activity in those incidents.
Check Point advises installing its November Jumbo Hotfix on all Management Servers and Security Gateways, beginning with internet-facing Mobile Access portals. The minimum listed releases are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Administrators should also review exposed gateways for the indicators of compromise in the vendor’s advisory. R81.10 and earlier versions are past end of support, according to the source material.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Root Access Matters
A Security Gateway sits at the boundary between an organization and its networks. A compromise can therefore create a route into systems that depend on the gateway, while root access gives an intruder extensive control over the appliance itself. The reported ESXi activity shows that, in some cases, attackers moved beyond the initial gateway to infrastructure where destructive activity could affect stored data.
The incident also involves two stages that administrators need to treat separately. Check Point says a PHP2Shell hotfix was available on Oct. 23, before the reported attacks began. The later root-access vulnerability was disclosed and fixed in the Nov. 12 Jumbo Hotfix. Installing the latter addresses the root flaw, but organizations still need to confirm that the earlier PHP fixes are present and investigate whether a device was compromised before patching.
CISA’s catalog entry brings the issue into federal remediation requirements, with agencies given until Nov. 16 to act. For other organizations, the catalog listing and Check Point’s incident findings are a signal to prioritize exposed gateways, while the vendor’s account does not establish that every system running the product was affected.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Bose TV Speaker (2nd Gen) – Compact Soundbar with Bluetooth and HDMI‑ARC Connectivity, Clear Dialogue, Dolby Atmos, Deep Bass, Remote Contro
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
The PHP vulnerabilities and the gateway root flaw serve different roles in the account. The PHP issues enabled initial remote code execution through the Mobile Access portal. CVE-2026-123039 then allowed a program already running on the appliance to invoke a privileged helper service and execute commands as root. Check Point rates the root flaw 7.8 out of 10 and says it requires local code execution, making the initial access a relevant part of the chain.
The PHP project released fixes on Oct. 21 for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, according to the source material. CISA added the two PHP flaws to its Known Exploited Vulnerabilities catalog on Oct. 26. Check Point says its gateway hotfix for PHP2Shell was available Oct. 23. The gateway’s separate root flaw did not receive a public fix until the Nov. 12 Jumbo Hotfix.
Check Point’s investigation describes evidence including PHP session files associated with exploitation and repeated crashes in portal web workers. The attackers then placed web shells in a directory used to build portal login pages and installed a back door called TSGA, which the company says can rename itself and persist through a restart. Those details support the vendor’s account of compromise; they do not, on their own, identify who was responsible.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Exposure Remain Open
Who carried out the operation is unknown. The back door belongs to a malware family that ESET has linked to a China-nexus group, according to the source material. But the destructive activity focused on Israeli organizations does not fit that group’s known interests, and Check Point says the evidence is insufficient for a high-confidence assessment. A malware-family link alone does not establish who deployed it.
The vendor’s estimate of a couple of dozen compromised systems applies to the incidents it observed, in a single region. The source material does not provide a total count of gateways scanned, exposed or vulnerable, nor does it establish how many organizations outside the observed cases may have been affected. It is also not clear whether every affected system experienced the same sequence or whether the second wave involved the same operator as the first.
Check Point’s report describes a back door and, in some cases, destructive activity on ESXi hosts. The available account does not establish the extent of data loss, whether all affected organizations recovered, or whether additional victims will be identified. Administrators should use the vendor’s indicators and their own records to assess individual systems rather than treating the reported count as a guarantee that other deployments are safe.
Patch, Then Check for Intrusion
Administrators should apply the November Jumbo Hotfix to Management Servers and Security Gateways, with internet-facing Mobile Access portals first, and verify that the correct Take level is installed for each software branch. They should also confirm that the PHP2Shell fix is present. Because attackers may have installed persistence before the root flaw was patched, applying an update should not replace a review for compromise.
Organizations should check exposed gateways against the indicators in Check Point’s advisory and investigate relevant logs and systems connected to them, including VMware ESXi hosts where the vendor’s reported activity makes that applicable. Systems on R81.10 or earlier are past end of support in the supplied account; administrators should consult Check Point’s support guidance for an upgrade or other remediation path rather than assume a supported hotfix is available.
U.S. federal agencies face CISA’s Nov. 16 deadline for the cataloged root-access flaw. Further clarity may come from updates to Check Point’s investigation, additional victim disclosures or evidence that helps security researchers assess attribution. As of the status reported at 21:30 UTC on Nov. 13, Check Point had not identified the attackers with confidence.
Key Questions
Which Check Point systems should administrators patch?
Check Point advises installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Minimum releases listed are Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20.
What vulnerabilities were involved?
The reported entry point involved PHP2Shell, covering CVE-2026-109618 and CVE-2026-109619. Attackers then used the separate root-access flaw CVE-2026-123039, according to Check Point.
Did the attacks destroy data?
Check Point says that in some incidents in the first wave, attackers reached VMware ESXi hosts and ran the destroy_v6 wiper, which overwrites files with zeros and deletes them. The company reported no evidence of destructive activity in the second wave. The full extent of data loss is not established in the supplied account.
Who was behind the attacks?
Attribution remains unresolved. A malware-family link has been associated with a China-nexus group, but Check Point says its evidence does not support a high-confidence assessment of the operation’s true nature.
What is the deadline for U.S. federal agencies?
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on Nov. 13, 2026, and gave federal agencies until Nov. 16 to act.
Source: ThorstenMeyerAI.com
