🔍 Read the full analysis: A Closer Look At Wiper Attacks Following PHP2Shell On Check Point on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from Oct. 30 to Nov. 4, using PHP2Shell flaws and a separate vulnerability to gain root access and install a back door. In some incidents targeting Israeli organizations, attackers moved to VMware ESXi servers and ran a wiper; a later wave showed no evidence of destructive activity. CISA added the root-access flaw to its exploited-vulnerabilities catalog and set a Nov. 16 deadline for U.S. federal agencies.
Check Point says attackers compromised a small number of unpatched Security Gateways between Oct. 30 and Nov. 4, exploiting PHP flaws and a separate vulnerability to gain root access and plant a back door. In some incidents targeting Israeli organizations, they moved from the gateways to VMware ESXi servers and ran a wiper that destroys data; Check Point reported no evidence of destructive activity in a second wave. The disclosure matters because the root-access flaw, CVE-2026-123039, was added to the U.S. Cybersecurity and Infrastructure Security Agency’s exploited-vulnerabilities catalog on Nov. 13, with federal agencies given until Nov. 16 to act.
Check Point’s Nov. 12 investigation describes a multi-stage intrusion. Attackers first reached unpatched gateways through the Mobile Access portal, using two PHP vulnerabilities known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Check Point says this gave them code execution as the portal’s service account. They then exploited CVE-2026-123039 to obtain root privileges on the appliance, allowing them to install web shells and a back door called TSGA.
In the first wave, which Check Point says targeted Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi host and ran a program named destroy_v6. The company says the wiper overwrites files with zeros and then deletes them. Its associated note, DREAM_ANNEXATION.txt, rejects ransom negotiations. A second wave on Nov. 2 affected organizations in multiple countries; Check Point said it found no evidence of destructive activity in those incidents.
Check Point says the attacks it investigated ran through Nov. 4 and affected “only a couple of dozen unpatched systems, in a single region.” It published fixes in its November Jumbo Hotfix. The vendor says its PHP2Shell hotfix had been available since Oct. 23, before the observed attacks began, but the separate root-access vulnerability and its fix were disclosed on Nov. 12. Check Point recommends installing the November hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Breaches Reached ESXi Hosts
The incidents show how a flaw exposed through a gateway’s web portal can become a foothold for broader network access. Check Point says attackers used the PHP vulnerabilities to execute code with limited privileges, then relied on a second flaw to become root on the appliance. In some cases, they went on to an ESXi server, where a wiper could disrupt access to stored data and services.
The reported scope is limited: Check Point describes a couple of dozen compromised unpatched systems in one region, not a broad confirmed impact across all customers. Even so, administrators need to treat exposed gateways as a potential entry point and check them for signs of compromise as well as apply the fix. CISA’s deadline adds an immediate compliance requirement for U.S. federal agencies, while other organizations face the operational risk of leaving affected systems exposed.
Products Worth Considering
LG UltraGear 32GS60QC-B 32-Inch QHD Curved Gaming Monitor
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
Logitech MX Master 3S Bluetooth Wireless Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
PHP2Shell refers to two critical vulnerabilities in PHP, a programming language used in web applications and embedded in some network appliances. The PHP project released fixes on Oct. 21 for supported versions including 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution. Because appliance software may include its own PHP components, users generally depend on the device manufacturer to provide and distribute an appliance-specific update.
Check Point’s account says the PHP flaws enabled initial code execution, but did not by themselves provide root access. The attackers then used CVE-2026-123039, which Check Point rates 7.8 out of 10, high severity. The vendor says the flaw requires an attacker to already have local code execution on the appliance. CISA added this root-access flaw to its Known Exploited Vulnerabilities catalog on Nov. 13 and set Nov. 16 as the deadline for federal agencies to address it.
Check Point’s November hotfix includes the relevant fixes. The vendor lists minimum patch levels of Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Check Point says R81.10 and older versions are past end of support. Administrators should confirm the appropriate update for their installation against the vendor’s current advisory.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Full Impact Remain Open
Check Point has not attributed the operation with high confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity and focus on Israeli organizations do not fit that group’s known interests. That association is not proof that the group carried out these attacks.
The vendor’s reported count covers the incidents it observed, and the available account does not establish how many additional systems may have been exposed or compromised outside that investigation. It is also unclear whether every affected organization experienced the same stages of the intrusion, or whether other victims were targeted without a wiper. Check Point reported no destructive evidence in the Nov. 2 wave, but that finding does not identify who was responsible or rule out other consequences.
Patch, Then Review Gateway Evidence
Organizations using affected Check Point appliances should install the November Jumbo Hotfix, starting with internet-facing Mobile Access portals, and verify that Management Servers and Security Gateways are covered. Check Point also advises examining exposed gateways for the indicators of compromise in its advisory; patching addresses the vulnerabilities but does not, by itself, establish whether an intrusion already occurred.
U.S. federal agencies must meet CISA’s Nov. 16 deadline for CVE-2026-123039. Other organizations should follow the vendor’s patch guidance and review their systems for the web shells, TSGA back door and other indicators Check Point lists. The next public developments to watch are any updated findings from Check Point or CISA about affected systems, attacker attribution, and whether additional organizations report destructive activity.
Key Questions
What happened in the Check Point attacks?
Check Point says attackers used two PHP2Shell flaws to gain code execution through unpatched Mobile Access portals, then exploited CVE-2026-123039 to obtain root access and install a back door. In some incidents, they moved to VMware ESXi hosts and ran a wiper.
Were all affected organizations hit with a wiper?
No. Check Point reported wiper activity in some incidents in a first wave targeting Israeli organizations. It said the second wave, which began Nov. 2 and affected organizations across multiple countries, showed no evidence of destructive activity.
Which Check Point systems should be updated?
Check Point recommends installing its November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. It lists minimum Take levels for R82.20, R82.10, R82 and R81.20; administrators should check the vendor advisory for their specific version.
Has Check Point identified the attackers?
No. Check Point says the evidence does not allow a high-confidence assessment of the operation’s nature. A link between the back-door malware family and a China-nexus group has been reported by ESET, but that link does not establish responsibility for these attacks.
What is the CISA deadline?
CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on Nov. 13 and gave U.S. federal agencies until Nov. 16 to act. The deadline applies to federal agencies; organizations should consult the vendor’s guidance for patching steps.
Source: ThorstenMeyerAI.com
