🔍 Read the full analysis: What Links PHP2Shell Exploits And Wiper Attacks On Check Point? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell to gain code execution and a separate flaw to reach root. In some incidents, attackers moved to VMware ESXi servers and ran a wiper; the company has not confidently attributed the activity. CISA added the root-access flaw to its exploited-vulnerability catalog on November 13 and set a November 16 deadline for US federal agencies.
Attackers used PHP2Shell flaws and a separate root-access vulnerability to compromise unpatched Check Point Security Gateways between October 30 and November 4, the company said, and in some incidents moved to VMware ESXi servers to run data-wiping malware. Check Point has not confidently identified who was behind the operation; the root flaw was added to the US Cybersecurity and Infrastructure Security Agency’s exploited-vulnerabilities catalog on November 13.
Check Point’s November 12 investigation describes a two-stage compromise. Attackers first reached the gateways through their Mobile Access portals, exploiting PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to run code with the portal service account’s limited permissions. They then used CVE-2026-123039, a separate vulnerability in the Gaia operating system, to obtain root access. Check Point rated that flaw 7.8 out of 10, or high severity.
Check Point reported that the first wave targeted Israeli organizations. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper named destroy_v6, which overwrites files with zeros before deleting them. A note left by the malware, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to the company. A second wave on November 2 targeted organizations in multiple countries; Check Point said it found no evidence of destructive activity in that wave.
The company said it observed compromises on “only a couple of dozen unpatched systems, in a single region.” It also said a PHP2Shell hotfix for its gateways had been available since October 23, before the reported attacks began. The fix for the separate root flaw was disclosed in the November Jumbo Hotfix, released on November 12. Check Point advises installing the update on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed systems for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Led to Data Destruction
The incidents show how an internet-facing network appliance can become a route into other parts of an organization’s infrastructure. In this case, the reported chain began with flaws reachable through a gateway’s web portal, then used a separate weakness to gain root-level control. Check Point says some attackers used that access to reach ESXi hosts, where data destruction could affect virtual machines and business services beyond the gateway itself.
The sequence also highlights the patching challenge for embedded software. PHP’s fixes for the two PHP2Shell flaws were released on October 21, but appliances that include PHP rely on their manufacturers to deliver device-specific updates. Check Point says its gateway hotfix for those flaws was available on October 23; the root-access issue required a later vendor fix. CISA’s November 16 deadline gives US federal agencies a near-term remediation requirement, while other organizations face the same practical need to update and investigate exposed devices.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Sony WH-1000XM6 Wireless Noise-Canceling Headphones, Black
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP project fixed them on October 21 in releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA says the flaws allow unauthenticated remote code execution in PHP, meaning an attacker can run commands on a vulnerable server without first logging in. Both flaws carry a CVSS score of 9.2 out of 10. CISA added them to its Known Exploited Vulnerabilities catalog on October 26.
Check Point says the PHP flaws provided the initial code execution, but did not by themselves provide root access. Its investigation says a Gaia helper service, DynamicCLI, ran as root and accepted commands through a local socket without checking the caller. An attacker who had already gained code execution on the appliance could use that weakness to elevate privileges. The distinction matters: PHP2Shell was the entry point, while CVE-2026-123039 provided the reported escalation to root.
CISA added CVE-2026-123039 to its catalog on November 13 and set November 16 as the deadline for US federal agencies to act. Check Point’s guidance identifies minimum Jumbo Hotfix levels: Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. The company says R81.10 and older versions are past end of support.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who conducted the operation remains unknown. Check Point said it could not assess the activity’s nature with high confidence. The back door used in the incidents belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity focused on Israel does not fit that group’s known interests. That connection is not proof that the group carried out these attacks.
The full extent of exposure is also not established by the reported count of compromised systems. Check Point’s “couple of dozen” figure applies to unpatched systems it observed in a single region. It does not state how many systems were exposed, how many organizations were affected across all waves, or whether other compromises went undetected. The company’s report describes destructive activity in some incidents in the first wave and no evidence of it in the second; that does not establish that every targeted organization was unaffected by other forms of intrusion.
The available source material also does not specify whether every identified back door or affected gateway was removed, or provide a complete public account of the attacker’s subsequent actions. Organizations need to use Check Point’s indicators and their own incident-response findings to determine whether a particular device was compromised.
Patch Gateways and Check for Intrusions
Organizations using Check Point Security Gateways should install the November Jumbo Hotfix at the applicable release level, with internet-facing Mobile Access portals first. Check Point recommends updating Management Servers as well as gateways. Administrators should then review every exposed gateway against the vendor’s published signs of compromise rather than treating installation alone as confirmation that a system is clean.
US federal agencies covered by CISA’s directive were given until November 16 to address CVE-2026-123039. Organizations on R81.10 or older should account for the fact that those releases are past end of support, according to Check Point. Further clarity will depend on vendor updates, agency actions and investigations that establish the scope of compromise and any reliable attribution.
Key Questions
What does PHP2Shell refer to in this incident?
It refers to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Check Point says attackers used them through Security Gateway Mobile Access portals to run code before exploiting a separate vulnerability for root access.
Did every compromised gateway lead to data destruction?
No. Check Point reported that attackers ran the destroy_v6 wiper on VMware ESXi hosts in some cases during a first wave targeting Israeli organizations. The company said it found no evidence of destructive activity in a second wave on November 2.
Who is believed to be behind the attacks?
Check Point has not attributed the attacks with confidence. A malware family used in the activity has been linked by ESET to a China-nexus group, but that association does not establish who conducted this operation.
What should Check Point customers do?
Install the November Jumbo Hotfix at the release-specific level listed by Check Point, including on Management Servers and Security Gateways. Prioritize internet-facing Mobile Access portals and check exposed systems for the vendor’s indicators of compromise.
What is the CISA deadline?
CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026, and gave US federal agencies until November 16 to act.
Source: ThorstenMeyerAI.com
