🔍 Read the full analysis: Patch Planning For Check Point Gateways Facing PHP2Shell Attacks on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers compromised a couple of dozen unpatched Security Gateways in one region between October 30 and November 4, using PHP2Shell flaws and a separate vulnerability to gain root access. The company’s November Jumbo Hotfix addresses the root flaw; CISA added it to its exploited-vulnerability catalog and set a November 16 deadline for federal agencies. Check Point has not attributed the operation with confidence.
Check Point says attackers compromised a couple of dozen unpatched Security Gateways in one region between October 30 and November 4, exploiting PHP2Shell vulnerabilities before using a separate flaw to gain root access. The company released a fix for that root-access flaw in its November Jumbo Hotfix, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its exploited-vulnerability catalog on November 13, giving federal agencies until November 16 to address it.
In its November 12 investigation, Check Point Research said the intrusions began through internet-facing Mobile Access portals on gateways that had not received the available PHP2Shell fix. The attackers used CVE-2026-109618 and CVE-2026-109619 to run code through the portal, then exploited CVE-2026-123039 to elevate their access to root, the appliance’s most privileged account. Check Point said the observed compromises involved “only a couple of dozen unpatched systems, in a single region.”
Check Point said the first wave targeted Israeli organizations. In some incidents, attackers moved from a gateway to a VMware ESXi server and ran a wiper called destroy_v6, which overwrites files with zeros and deletes them. A note left by the malware, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to the vendor. A second wave on November 2 reached organizations in multiple countries; Check Point said it found no evidence of destructive activity in that wave.
The company said its PHP2Shell hotfix for gateways was available on October 23, a week before the observed attacks began. The separate root-access flaw was disclosed and fixed in the November Jumbo Hotfix on November 12. Check Point recommends installing that hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for the compromise indicators in its advisory. The minimum listed takes include Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Root Access Matters
A compromised security gateway can give an intruder a position inside the boundary organizations rely on to control network access. In these incidents, Check Point says the attackers combined remote code execution through a web-facing portal with a second vulnerability that turned limited access into root privileges. That sequence raises the stakes beyond a vulnerable web service: the gateway itself could be used to maintain access, and in some observed cases the intrusion extended to an ESXi host.
The reported wiper activity means the incidents were not limited to data theft or covert access. Check Point describes destructive activity in some cases during the Israeli-focused wave, while reporting none in the later, broader wave. Organizations should treat exposure as a reason to patch and investigate, but the available account does not establish that every vulnerable gateway was compromised or that every intrusion involved destruction.
The advisory also matters for operational planning. Applying the vendor’s listed hotfix and reviewing indicators are separate tasks: installing an update closes the known vulnerability, but it does not by itself establish whether an exposed appliance was previously accessed. Organizations using these gateways need to identify affected versions, prioritize externally reachable portals, and review the vendor’s detection guidance.
Products Worth Considering
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Samsung Galaxy Tab A11+ Kids Edition, 128 GB Android Tablet, Royal Blue
As an affiliate, we earn on qualifying purchases.
How PHP2Shell Reached Gateways
PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP project issued fixes on October 21 for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution. It added both to its Known Exploited Vulnerabilities catalog on October 26 and cautioned that PHP may be bundled inside other products, making its presence difficult to identify from outside.
That packaging issue is relevant to network appliances: a device maker, rather than a customer updating PHP independently, may need to deliver the correction as part of a product update. Check Point said its gateway hotfix for PHP2Shell was available October 23. The later root-access vulnerability was a distinct issue: the vendor says it required code execution already on the appliance, which the PHP flaws could provide. Its November Jumbo Hotfix addresses that second flaw as well as the vendor’s stated remediation steps.
Check Point’s investigation says the attackers placed web shells in a Mobile Access portal directory and installed a back door called TSGA. The company describes the back door as renaming itself and persisting across a restart. These details are findings attributed to the vendor’s investigation; the attack sequence should not be read as evidence that every affected gateway was compromised in the same way.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who conducted the attacks remains unknown. The back door belongs to a malware family that ESET has linked to a China-nexus group, but Check Point said the evidence does not support a high-confidence assessment of the operation’s true nature. The reported destructive activity against Israeli organizations also does not fit the group’s known interests, according to the source material; that mismatch is not proof of who was responsible.
The vendor’s estimate covers the systems compromised in the incidents it investigated. The total number of vulnerable or exposed gateways, how many organizations were affected beyond those observed, and whether other intrusions went undetected are not stated. It is also unclear from the available information whether every installed instance of the back door or web shells has been identified and removed.
Check Point’s account distinguishes a first wave with some destructive activity from a second wave with no evidence of destruction. The public material provided does not establish whether the waves had the same operator, whether data was taken, or whether the attackers retained access after the fixes became available.
Patch, Inspect, and Track CISA
Organizations running Check Point Security Gateways should install the November Jumbo Hotfix on Management Servers and Gateways, starting with internet-facing Mobile Access portals. Administrators should match their software release to Check Point’s listed minimum take, and should check the vendor’s advisory for the applicable package and indicators. Versions R81.10 and older are past end of support, according to the source material, so operators using them need to account for that status when planning remediation.
After patching, teams should review every gateway exposed during the attack period for the indicators Check Point lists. CISA’s November 16 deadline applies to U.S. federal agencies for the root-access vulnerability; other organizations should follow their own requirements while treating the vendor’s remediation guidance as relevant to their exposure. Additional details may emerge through updated vendor advisories or public threat reporting, but Check Point has not announced a confident attribution.
Key Questions
Which vulnerabilities were involved?
The initial access route involved CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Check Point says attackers then used CVE-2026-123039 to gain root access on the gateway.
What should Check Point gateway operators do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Then inspect exposed systems using the indicators in Check Point’s advisory.
Did the attacks destroy data?
Check Point said attackers ran a wiper on some VMware ESXi servers during the first wave targeting Israeli organizations. It reported no evidence of destructive activity in the November 2 wave across multiple countries.
Who was behind the attacks?
Attribution is unresolved. Check Point said the evidence does not allow a high-confidence assessment. A link between the back-door family and a China-nexus group has been reported, but it does not establish that group carried out this operation.
What is the federal deadline?
CISA gave U.S. federal agencies until November 16, 2026, to address CVE-2026-123039 after adding it to its exploited-vulnerability catalog on November 13.
Source: ThorstenMeyerAI.com
