🔍 Read the full analysis: A Practical Guide To Patching Check Point Gateways After Attacks on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP flaws to get in and a separate vulnerability to gain root access. The company released fixes on November 12; it recommends installing the November Jumbo Hotfix, prioritizing internet-facing Mobile Access portals, and checking exposed systems for signs of compromise. CISA set a November 16 deadline for U.S. federal agencies to address the root-access flaw.
Check Point says attackers compromised a small number of unpatched Security Gateways between October 30 and November 4, using flaws in the gateways’ Mobile Access portal and a separate vulnerability to gain root access. The company published its incident report and a fix in the November Jumbo Hotfix on November 12; CISA added the root-access flaw to its catalog of exploited vulnerabilities on November 13 and set a November 16 deadline for U.S. federal agencies to act.
Check Point’s investigation says attackers first exploited two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. The flaws could allow remote code execution through the gateways’ Mobile Access portal. Attackers then used CVE-2026-123039 to elevate their access to root, the appliance’s highest-privilege account, and installed tools for continued access.
Check Point said the observed incidents involved “only a couple of dozen unpatched systems, in a single region.” It described an initial wave targeting Israeli organizations in which attackers sometimes moved from a gateway to a VMware ESXi server and ran a destructive program called destroy_v6. A second wave, beginning November 2 and affecting organizations in multiple countries, showed no evidence of destructive activity, according to the company.
The vendor’s recommended action is to install the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with internet-facing Mobile Access portals, and then inspect exposed gateways for indicators of compromise listed in its advisory. The stated minimum hotfix takes are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point says R81.10 and older versions are past end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Patching Closes Two Attack Stages
The incident illustrates why patching only the initial entry point may not be enough when attackers can chain vulnerabilities. Check Point says a PHP2Shell hotfix was available on October 23, before the reported attacks began. But the separate root-access flaw, which attackers used after obtaining code execution, was disclosed and fixed in the November Jumbo Hotfix on November 12.
For organizations running these gateways, the practical concern is both preventing new access and determining whether a system was already compromised. A root-level foothold can give an intruder broad control over an appliance, while a gateway may provide a route into other parts of a company network. The reported wiper activity also means affected organizations may need to assess connected infrastructure, including VMware ESXi hosts, rather than treating the firewall as an isolated device.
The scope described by Check Point is limited to the incidents it observed, not a complete count of every potentially exposed system. Its “couple of dozen” figure is a raw count, and the company’s statement specifies a single region; it does not establish the total number of vulnerable or compromised gateways worldwide.
Products Worth Considering
Apple Mac mini Desktop Computer with M6 Chip (2026)
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Blush
As an affiliate, we earn on qualifying purchases.
How PHP2Shell Led to Root Access
PHP2Shell refers to two critical flaws in PHP that can permit unauthenticated remote code execution. The PHP project released fixes on October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. The source material says PHP is often embedded in other products, so customers may depend on the appliance maker to deliver and package a fix rather than updating PHP independently.
In Check Point’s account, exploitation gave attackers code execution as the Mobile Access portal’s service account. They then used CVE-2026-123039, a flaw in the Gaia operating system’s DynamicCLI helper service, to elevate privileges. Check Point rates that flaw 7.8 out of 10, or high, and says it requires an attacker to already have local code execution on the appliance. The company reported that attackers placed web shells in the portal’s login-page directory and deployed a back door called TSGA.
Check Point released its investigation, advisory and fixes on November 12. The PHP fixes had been available earlier, but the source material says the fix for the root-access vulnerability was included in the November Jumbo Hotfix. CISA’s November 13 catalog entry added a separate federal-agency action deadline.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks remains unclear. Check Point said it could not assess the operation’s nature with high confidence. The source material says the back door belongs to a malware family that ESET has linked to a China-nexus group, but also notes that the destructive activity and Israel-focused first wave do not fit that group’s known interests. That association is not a confirmed attribution.
The full scale of exposure is also unknown from the available information. Check Point’s reported figure covers the systems it observed in a single region; it does not say how many other gateways were vulnerable, whether there were unobserved intrusions, or how many victims suffered data loss. Details about the second wave are limited, beyond Check Point’s statement that it found no evidence of destructive activity there.
The source material does not provide a complete set of forensic indicators or technical remediation steps beyond installing the hotfix and checking exposed systems against Check Point’s advisory. Organizations should use the vendor’s current advisory for the detailed indicators and instructions rather than infer that patch installation alone proves a system is clean.
Apply Hotfix and Review Gateways
Organizations using affected Check Point appliances should apply the November Jumbo Hotfix at the applicable minimum take level, prioritizing gateways with internet-facing Mobile Access portals. They should also review exposed systems for the indicators Check Point lists and assess whether connected hosts require investigation. Systems on R81.10 or earlier are past end of support, according to the vendor, so administrators should consult Check Point’s guidance on supported versions and remediation.
U.S. federal agencies had until November 16 to address CVE-2026-123039 under the CISA catalog action described in the source material. The available account does not specify what additional findings Check Point or CISA may publish after that date. Further information about the number of victims, any data loss and attribution will depend on subsequent investigation and disclosures.
Key Questions
Which Check Point systems should be patched?
Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The stated minimum takes are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
What vulnerabilities were used in the attacks?
Check Point says attackers used CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, to obtain code execution through Mobile Access. They then used CVE-2026-123039 to gain root privileges on the appliance.
Were all affected organizations hit with a wiper?
No. Check Point reported destructive activity in some incidents in the first wave targeting Israeli organizations. It said the later wave across multiple countries showed no evidence of destructive activity.
Is the attacker’s identity known?
No. Check Point said the evidence does not allow a high-confidence assessment of who was responsible. A malware-family link reported in the source material is not a confirmed attribution.
Does installing the hotfix confirm a gateway is clean?
The source material does not say that patching alone confirms a system has not been compromised. Check Point recommends applying the fix and checking exposed gateways for its listed indicators of compromise.
Source: ThorstenMeyerAI.com
