🔍 Read the full analysis: What To Patch After Attackers Target Check Point Gateways on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP vulnerabilities to gain access and a separate flaw to reach root. The company’s November Jumbo Hotfix addresses the issues; CISA has ordered U.S. federal agencies to act by November 16. Check Point has not attributed the campaign with confidence.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, using vulnerabilities reached through the devices’ Mobile Access portals and a separate flaw to gain root access. The company released fixes in its November Jumbo Hotfix on November 12, and CISA added the root-access flaw, CVE-2026-123039, to its exploited-vulnerabilities catalog on November 13, setting a November 16 deadline for U.S. federal agencies.
Check Point’s investigation describes a two-stage intrusion. Attackers first exploited PHP2Shell, a pair of critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, through exposed Mobile Access portals on gateways that had not received the relevant fix. They then used CVE-2026-123039 to obtain root privileges on the appliance. Check Point rates the root-access flaw 7.8 out of 10 and says it requires an attacker to already have local code execution.
Check Point says a first wave targeted Israeli organizations. In some incidents, attackers moved from a gateway to a VMware ESXi host and ran a wiper named destroy_v6, which overwrites files with zeros and deletes them. A note called DREAM_ANNEXATION.txt rejected ransom negotiations. A second wave, on November 2, targeted organizations in multiple countries; Check Point reported no evidence of destructive activity in that wave.
The vendor said only “a couple of dozen unpatched systems, in a single region” were compromised in the incidents it observed. It says a PHP2Shell hotfix for its gateways had been available since October 23, before the reported attacks began. The fix for the separate root flaw was included in the November Jumbo Hotfix. Check Point advises installing that hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, then checking exposed appliances for the compromise indicators in its advisory.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Patching Matters
Security Gateways sit between external traffic and an organization’s internal systems. In these incidents, exploiting a web-facing portal reportedly gave attackers an initial foothold, and the second flaw let them escalate from limited access to root control of the appliance. That combination can turn a perimeter device into a route toward other systems, as Check Point’s account of movement to an ESXi host illustrates.
The reported wiper activity means the risk was not limited to unauthorized access or data theft: some affected organizations faced destructive activity against files. Check Point says it observed only a couple of dozen compromised unpatched systems in one region, but that figure describes the incidents it investigated, not the total number of exposed or potentially affected devices. Organizations should treat the vendor’s patch and investigation guidance as relevant even if they have not confirmed an intrusion.
CISA’s November 16 deadline applies to U.S. federal agencies; it is not stated as a deadline for all organizations. Other operators still need to determine their own exposure and response based on whether affected gateways were unpatched and reachable through Mobile Access.
Products Worth Considering
Canon SELPHY CP1500 Wireless Dye-Sublimation Photo Printer Bundle with 108 Sheets of Paper and 3 Ink Cartridges
HP OfficeJet 250 Wireless Mobile All-in-One Inkjet Printer
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
As an affiliate, we earn on qualifying purchases.
How the Two-Flaw Chain Worked
The PHP project fixed CVE-2026-109618 and CVE-2026-109619 on October 21 in PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA added both to its Known Exploited Vulnerabilities catalog on October 26. Its advisory says the flaws can allow unauthenticated remote code execution and cautions that PHP may be embedded in other products, making affected systems hard to identify from PHP inventories alone. Network appliances may need a vendor-issued update rather than a direct PHP upgrade.
According to Check Point’s November 12 technical report, attackers first ran code through the Mobile Access portal, then exploited a Gaia operating-system helper service called DynamicCLI. Check Point says the service ran as root and accepted commands through a local socket without checking the caller. That made the root flaw useful only after attackers had already obtained local code execution through the PHP vulnerabilities.
After gaining root, attackers placed web shells in a directory used by the portal and installed a back door Check Point calls TSGA, which it says could persist through a restart. Check Point’s investigation covers activity from October 30 through November 4. The vendor’s public disclosure and fixes followed on November 12.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks remains unknown. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the supplied reporting says the destructive, Israel-focused activity does not fit that group’s known interests. Check Point has not said it can confidently identify the actor, and the malware link alone does not establish who was responsible.
The full scope is also uncertain. Check Point’s “couple of dozen” figure refers to compromised unpatched systems in observed incidents in one region; it does not establish how many gateways were exposed, whether other intrusions went undetected, or whether the reported victims represent the whole campaign. The supplied material does not provide a complete victim list or a confirmed count of organizations affected by the second wave.
It is not clear from the available account whether every compromised gateway was identified or whether every affected organization also experienced activity on an ESXi server. Check Point’s report says destructive activity occurred in some first-wave cases, not all of them. Organizations must compare their own logs and systems against the indicators in the vendor’s advisory.
Install the Hotfix and Review Systems
Check Point’s immediate direction is to install the November Jumbo Hotfix on Management Servers and Security Gateways, starting with internet-facing Mobile Access portals, and then investigate exposed systems for the indicators listed in its advisory. The specified minimum takes are Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Administrators should consult Check Point’s current advisory for applicable installation details and supported versions.
Check Point says R81.10 and older releases are past end of support. Organizations operating those versions should not assume they can address the issue with a supported hotfix without checking the vendor’s guidance on upgrade or replacement. CISA’s November 16 deadline is the next stated milestone for U.S. federal agencies; the supplied information does not specify a comparable deadline for other operators.
After patching, security teams should review authentication and Mobile Access activity, search for the vendor’s listed indicators, and check connected infrastructure, including ESXi hosts, for signs of follow-on activity. The available sources do not state whether Check Point plans another update or provide a date for further findings. Attribution and the broader scope may become clearer as investigations continue.
Key Questions
Which Check Point products should administrators patch?
Check Point says to install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing gateways with internet-facing Mobile Access portals. The vendor lists minimum takes for R82.20, R82.10, R82 and R81.20 in its guidance.
What did attackers exploit?
Check Point says attackers reached unpatched gateways through Mobile Access using two PHP flaws, CVE-2026-109618 and CVE-2026-109619. They then used CVE-2026-123039 to escalate to root, according to the vendor’s investigation.
Did every affected organization suffer data destruction?
No. Check Point reported wiper activity in some incidents in a first wave targeting Israeli organizations. It said the November 2 wave across multiple countries showed no evidence of destructive activity.
Who was behind the attacks?
The attacker has not been identified with confidence. Check Point said its evidence was insufficient to assess the operation’s true nature with high confidence; a malware-family association reported by ESET does not establish attribution.
What is the deadline for patching?
CISA gave U.S. federal agencies until November 16, 2026, to act after adding CVE-2026-123039 to its exploited-vulnerabilities catalog on November 13. The supplied information does not set the same deadline for private organizations or other governments.
Source: ThorstenMeyerAI.com
