🔍 Read the full analysis: How A Check Point Gateway Attack Can Progress To Wiper Malware on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Check Point says attacks from October 30 to November 4 exploited unpatched Security Gateways, used a second flaw to gain root access and installed a back door. In some cases in an Israel-focused first wave, attackers reached VMware ESXi servers and ran a wiper; a later wave showed no evidence of destructive activity. The company released fixes on November 12, and CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13.
Attackers compromised unpatched Check Point Security Gateways between October 30 and November 4, then used a second flaw to gain root access and install a back door, the company said. In some incidents, the intruders moved from the gateways to VMware ESXi servers and ran data-wiping malware; Check Point says a second wave showed no evidence of destructive activity.
Check Point’s November 12 investigation says the intrusions began with PHP2Shell, two critical PHP flaws identified as CVE-2026-109618 and CVE-2026-109619. Attackers reached the vulnerabilities through the gateways’ Mobile Access portal, gaining code execution under the portal service account. They then exploited CVE-2026-123039 to obtain root privileges on the appliance.
With that access, attackers placed web shells in the Mobile Access portal’s login-page directory and installed a back door known as TSGA, which Check Point says could persist through a restart. In some incidents from the first wave, which targeted Israeli organizations, they moved to an ESXi host and ran a wiper called destroy_v6. The malware overwrites files with zeros before deleting them. Its note, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations, according to Check Point.
Check Point said it observed compromises of “only a couple of dozen unpatched systems, in a single region”. A second wave on November 2 targeted organizations in multiple countries, but the company reported “no evidence of destructive activity” in those incidents. Check Point has not attributed the attacks with confidence.
The vendor said a hotfix for PHP2Shell on its gateways had been available on October 23, before the observed attacks began. The separate root-access flaw was disclosed and fixed in the November Jumbo Hotfix, released November 12. Check Point advises customers to install that hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and then investigate exposed gateways for signs of compromise.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Put ESXi Data at Risk
The incidents show how a flaw in an internet-facing gateway can become a route to high-impact systems behind the network boundary. The attackers did not stop at running code in the portal: they chained that access to a root-level weakness, established persistence, and in some cases reached VMware infrastructure where data could be destroyed.
The reported wiper activity makes the distinction between the two waves important. Check Point found destructive activity in some first-wave cases, but said it had no evidence of such activity in the November 2 wave. Customers should not treat the wiper as proof that every compromised gateway led to data loss; the source material describes a limited set of observed incidents, not the full extent of possible exposure.
For organizations using these gateways, the immediate concern is both patching and checking for prior compromise. Installing the hotfix closes the identified weakness, but does not by itself establish whether an attacker had already gained access or left a back door behind.
Popular right now
Ninja Air Fryer XL with MaxCrisp, 6.5 Qt, 6-in-1, Dark Grey (AF181)
Dyson Gen5 Outsize Cordless Vacuum
Dyson Purifier Cool PC2 De-NOx
As an affiliate, we earn on qualifying purchases.
Two Flaws Completed the Intrusion Chain
PHP2Shell refers to two critical vulnerabilities in PHP. The PHP project fixed them on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution in affected PHP systems. Check Point’s advisory said they could permit remote code execution through firewall web interfaces. The vendor’s gateway hotfix for these flaws was available October 23.
The gateway attack required another weakness to escalate access. Check Point says CVE-2026-123039 affected DynamicCLI, a Gaia operating-system helper service that ran as root and listened on a local socket without checking the caller’s identity. The company rated the flaw 7.8 out of 10, or high, and said an attacker needed local code execution first. PHP2Shell supplied that initial foothold. CISA added the root-access flaw to its Known Exploited Vulnerabilities catalog on November 13, with a November 16 deadline for U.S. federal agencies to act.
Check Point’s listed hotfix levels include Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says R81.10 and earlier versions are beyond end of support. Administrators should consult Check Point’s advisory for the relevant system and remediation instructions.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who conducted the operation is not established. The back door belongs to a malware family ESET has linked to a China-nexus group, according to the source material, but the reported destructive activity against Israeli organizations does not fit that group’s known interests. Check Point said the available evidence was insufficient for a high-confidence assessment.
The public account also does not establish whether every compromised gateway was found, how many organizations may have been exposed beyond the incidents Check Point investigated, or whether additional systems were reached. The company’s statement about a couple of dozen systems refers to observed compromises in one region. It is not a measure of all systems that were vulnerable or targeted.
It remains unclear how many affected organizations experienced successful data destruction, beyond the report that the wiper ran in some first-wave cases. The available material also does not provide a complete account of the second wave’s outcomes or confirm whether other tools or methods were used.
Patch Gateways and Check for Persistence
Administrators should install the November Jumbo Hotfix on affected Check Point Management Servers and Security Gateways, beginning with internet-facing Mobile Access portals. They should use the version-specific hotfix levels in Check Point’s advisory and address unsupported versions, including R81.10 and earlier, with a supported upgrade or other guidance from the vendor.
After patching, organizations should review exposed gateways for the indicators Check Point listed and assess connected systems, including ESXi hosts, for signs of access or destructive activity. A patched device may still require investigation if it was exposed during the attack window. U.S. federal agencies also face the November 16 CISA remediation deadline for CVE-2026-123039. Further attribution or incident details may emerge as investigations continue.
Key Questions
What happened in the Check Point gateway attacks?
Check Point says attackers used PHP2Shell flaws to get code execution through Mobile Access portals, then exploited CVE-2026-123039 to gain root access. They installed a back door, and in some first-wave incidents moved on to ESXi servers and ran a wiper.
Did the attacks destroy data at every affected organization?
No. Check Point reported wiper activity in some incidents from the Israel-focused first wave. It said there was no evidence of destructive activity in the November 2 wave. The available account does not give a complete count of organizations that lost data.
Which Check Point systems should be patched?
Check Point recommends the November Jumbo Hotfix for Management Servers and Security Gateways, with internet-facing Mobile Access portals prioritized. Listed levels include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Administrators should consult the vendor advisory for their specific system.
Is the attacker’s identity known?
No. Check Point said it could not assess the operation’s nature with high confidence. A link between the back-door family and a China-nexus group has been reported, but the source material says the attack’s characteristics do not fit that group’s known interests.
Source: ThorstenMeyerAI.com
