🔍 Read the full analysis: How Attackers Turn Check Point Gateway Access Into Wiper Malware on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, gained root access and planted a back door. In some incidents involving Israeli organizations, they reached VMware ESXi hosts and ran a wiper; a later wave showed no evidence of destructive activity. The company released fixes on November 12, and CISA added the root-access flaw to its exploited-vulnerability catalog on November 13.
Attackers compromised unpatched Check Point Security Gateways between October 30 and November 4, then installed a back door and, in some cases, used a wiper against VMware ESXi servers, according to the company’s investigation. Check Point says the incidents began with critical PHP flaws exposed through Mobile Access portals and escalated through a separate vulnerability that granted root access; the findings matter to organizations that use these gateways to protect network access and manage remote connections.
Check Point Research says the attackers first exploited PHP2Shell, CVE-2026-109618 and CVE-2026-109619, through the gateways’ Mobile Access portal. The flaws allowed unauthenticated remote code execution, meaning an attacker could run commands without first logging in. That access initially ran under the portal’s service account, which had limited privileges. The attackers then used CVE-2026-123039 to gain root access on the appliance, according to the report.
After gaining root, the attackers placed PHP web shells in a directory used by the Mobile Access portal and installed a back door Check Point identifies as TSGA. The company says this malware could persist through a restart. In incidents involving Israeli organizations, attackers also moved to VMware ESXi hosts and ran a wiper called destroy_v6. Check Point says it overwrites files with zeros and deletes them. Its note, named DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations.
Check Point distinguishes those incidents from a second wave on November 2 targeting organizations in multiple countries. The company reported no evidence of destructive activity in that wave. It said that only “a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.” The company’s report does not establish that every targeted organization was successfully breached.
The fixes are in Check Point’s November Jumbo Hotfix, published on November 12. The company recommends installing it on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. It lists minimum takes of 14 for R82.20, 52 for R82.10, 132 for R82 and 174 for R81.20. Check Point also advises administrators to inspect exposed gateways for signs of compromise. R81.10 and older versions are past end of support, according to the source material.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Root Access Matters
A network security gateway sits at a boundary between an organization and outside connections. A breach can give attackers a foothold on a device that administrators rely on to control access, while root privileges can let them make changes that are difficult to detect or remove. Here, the reported sequence joined remote code execution, root access and persistent access, then extended in some cases to servers hosting virtual machines.
The wiper incidents raise the potential cost beyond the loss of a gateway. If a wiper damages files on an ESXi host, organizations may face disruption to virtualized systems and the work they support. Check Point’s account does not quantify the resulting damage or name affected organizations, so the operational impact cannot be determined from the report. The distinction between the destructive first wave and the later wave, for which the company found no evidence of destructive activity, is important when assessing the scope.
The patch timeline also shows why security-device vulnerabilities can require coordinated action. Check Point says its PHP2Shell hotfix was available October 23, before the reported attacks started, but the separate root flaw was fixed in the November 12 Jumbo Hotfix. Administrators may need to update multiple gateways and management systems, then review logs and files for evidence that an attacker had already gained access.
Popular right now
KitchenAid 3-Piece Pasta Roller and Cutter Set for Stand Mixers
De'Longhi La Specialista Touch Semi-Automatic Espresso Machine with Grinder
Roborock Q7 L5 Robot Vacuum and Mop Combo
As an affiliate, we earn on qualifying purchases.
How the Two Flaws Combined
The PHP project released fixes for the PHP2Shell flaws on October 21, in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added those flaws to its Known Exploited Vulnerabilities catalog on October 26. However, network appliances can bundle PHP within their own software, so users generally depend on the device maker to provide an appliance-specific update. Check Point says its gateway hotfix for PHP2Shell became available on October 23.
The second flaw had a different role. According to Check Point, a Gaia operating-system helper called DynamicCLI ran as root and listened on a local socket that did not verify which local program was connecting. An attacker who had already achieved code execution on the appliance could use that weakness to obtain root privileges. Check Point rates CVE-2026-123039 7.8 out of 10, or high, and says exploitation requires prior local code execution. The PHP vulnerabilities supplied that initial access in the incidents described.
CISA added CVE-2026-123039 to its catalog of exploited vulnerabilities on November 13 and set November 16 as the deadline for U.S. federal agencies to act. Check Point published its investigation, advisory and fixes a day earlier. This chronology separates the available PHP-related patch from the later fix for the root-access flaw; applying one update does not, by itself, establish whether a previously exposed device was compromised.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Damage Remain Open
Who carried out the attacks remains uncertain. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity focused on Israel and does not fit that group’s known interests. Check Point says it cannot assess the operation’s nature with high confidence. The malware link alone does not establish who was responsible for these incidents.
The full impact also remains unclear. Check Point reported a couple of dozen compromised systems in a single region, but did not name the affected organizations or provide a total for attempted intrusions, damaged ESXi hosts, or lost data. Its account says there was no evidence of destructive activity in the November 2 wave; that wording does not confirm that the wave caused no other effects. Administrators will need to assess their own systems for compromise rather than infer safety from the reported count.
The source material includes a partial description of TSGA’s behavior but does not provide a complete technical account of all indicators or every affected configuration. It also does not specify how many organizations installed the October 23 PHP2Shell hotfix before the attacks or how many remain exposed. Those details may change as investigations and vendor guidance develop.
Patch, Inspect and Meet Deadlines
Organizations using Check Point gateways should install the November Jumbo Hotfix on Management Servers and Security Gateways, with internet-facing Mobile Access portals first, and confirm they are on a supported release. They should then review exposed systems against Check Point’s published indicators and investigate any signs of unauthorized access. Applying a fix addresses the vulnerabilities, but does not show whether an attacker entered before the update.
U.S. federal agencies face a separate near-term deadline: CISA’s catalog entry for CVE-2026-123039 calls for action by November 16. Agencies and other organizations should track updated Check Point advisories and CISA guidance for any revised indicators or remediation instructions. The number of affected customers, confirmed damage and any eventual attribution remain open as the company’s investigation continues.
Key Questions
What happened to the Check Point gateways?
Check Point says attackers used PHP2Shell flaws through Mobile Access portals, then exploited a separate flaw to gain root access. They installed a back door and, in some incidents, ran a wiper against VMware ESXi hosts.
Which flaw gave attackers root access?
CVE-2026-123039 was the root-access flaw, according to Check Point. The company says attackers first needed local code execution, which the PHP2Shell vulnerabilities could provide.
Did all attacks include data destruction?
No. Check Point reported wiper activity in some incidents involving Israeli organizations. It said a second wave targeting organizations in multiple countries showed no evidence of destructive activity.
What should Check Point customers do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Check Point also advises inspecting exposed gateways for signs of compromise and using supported software versions.
Who was responsible for the attacks?
That has not been established. Check Point says the available evidence does not support a high-confidence assessment of the operation, and a malware-family link cited in the source material does not prove attribution.
Source: ThorstenMeyerAI.com
