🔍 Read the full analysis: Could PHP2Shell Be The Start Of A Wiper Attack On Check Point? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways from October 30 to November 4, using PHP2Shell flaws and a separate root-access flaw. In some incidents targeting Israeli organizations, attackers moved to VMware ESXi servers and ran a wiper; a later wave showed no evidence of destructive activity. CISA added the root flaw to its exploited-vulnerabilities catalog and set a November 16 deadline for U.S. federal agencies.
Check Point says attackers compromised a small number of unpatched Security Gateways between October 30 and November 4, using PHP2Shell vulnerabilities to gain entry and a separate flaw to obtain root access. In some cases involving Israeli organizations, the attackers moved to VMware ESXi servers and ran a wiper that destroys data; Check Point reported no evidence of destructive activity in a second wave. The disclosure matters because the incidents combined remote access to network appliances with a destructive payload, while the identity and purpose of the operators remain unresolved.
Check Point’s November 12 investigation says the attackers reached vulnerable gateways through the Mobile Access portal. PHP2Shell refers to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which can enable unauthenticated remote code execution. The attackers then used CVE-2026-123039 to move from code execution with limited privileges to root, the appliance’s highest-privilege account. Check Point rates that second flaw high severity, with a CVSS score of 7.8 out of 10.
Check Point said the first observed wave targeted Israeli organizations. In some incidents, operators moved from a gateway to a VMware ESXi host and launched a wiper called destroy_v6, which overwrites files with zeros and then deletes them by default. The malware left a note named DREAM_ANNEXATION.txt that, according to Check Point, explicitly rejected ransom negotiations. A second wave, beginning November 2 and affecting organizations in multiple countries, showed no evidence of destructive activity in the vendor’s investigation.
The company said only a couple of dozen unpatched systems in one region were compromised in the incidents it observed. That is Check Point’s account of the cases it investigated, not a count of all potentially exposed devices. It says the PHP2Shell hotfix for gateways was available October 23, before the observed attacks began. The root-access flaw was disclosed and fixed in the November Jumbo Hotfix, published November 12. Check Point advises installing that hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, then checking exposed systems for its listed compromise indicators.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Became a Wiper Route
The incidents show why a compromised network appliance can matter beyond the appliance itself. Attackers used the gateway as an entry point, gained root access, and in some cases reached an ESXi server where they ran destructive software. If an organization’s virtualization host is damaged, the effects can extend to many workloads and stored files, although Check Point has not provided a broader impact total.
The reported waves also call for careful distinction between intrusion and destruction. Check Point found a wiper in some first-wave cases, but said it saw no evidence of destructive activity in the later, geographically broader wave. The findings do not establish that every compromised gateway led to a wiper deployment or that the same objective applied across all incidents.
For defenders, the timing presents a practical concern: a fix for the PHP flaws existed before the observed attacks, but a separate route to root was not publicly fixed until November 12. Organizations need to address both the gateway software and possible signs of persistence, rather than treating installation of one patch as proof that a previously exposed device is clean.
Products Worth Considering
Samsung Galaxy Tab A11+ Kids Edition, 128 GB Android Tablet, Royal Blue
Jackery Solar Generator 1000 v2 with 100W Solar Panel
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
As an affiliate, we earn on qualifying purchases.
Two Flaws in One Intrusion Chain
PHP2Shell is the name used for two critical flaws in PHP, the programming language embedded in many websites and network appliances. The PHP project released fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA says the flaws can allow unauthenticated remote code execution. It added both to its Known Exploited Vulnerabilities catalog on October 26 and has warned that PHP can be bundled inside other products, making affected systems difficult to identify from PHP version information alone.
Appliance customers generally depend on the manufacturer to incorporate software fixes into a supported device update. In this case, Check Point says it made a PHP2Shell hotfix available on October 23. The observed attacks began October 30, according to its report. The separate DynamicCLI root-access flaw required an attacker to already have code execution on the appliance, making it a second stage in the reported chain rather than the initial entry point.
Check Point’s November 12 Jumbo Hotfix includes the root-flaw fix. The vendor lists minimum relevant hotfix takes as Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point says R81.10 and older versions are past end of support. CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on November 13 and directed U.S. federal agencies to act by November 16.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Full Impact Remain Open
Who carried out the attacks is not confirmed. The back door is associated with a malware family that ESET has linked to a China-nexus group, but the source material says the Israel-focused destructive activity does not fit that group’s known interests. A malware-family link alone does not establish who operated it in these incidents, and Check Point says it cannot assess the operation’s nature with high confidence.
The total number of exposed gateways, the full extent of any access, and whether data was lost or systems were restored are not specified in the available account. Check Point’s statement about a couple of dozen compromised systems is limited to the incidents it observed. Its finding of no destructive activity in the second wave does not rule out other effects that were not detected or reported.
It is also not clear from the source material whether every potentially affected organization has applied the updates or completed checks for persistence. The account identifies back doors and web shells, but does not provide a complete public tally of organizations notified, compromised ESXi hosts, or affected workloads.
Patch, Check, and Track Updates
Organizations using Check Point Security Gateways should install the vendor’s November Jumbo Hotfix on all relevant Management Servers and Gateways, starting with internet-facing Mobile Access portals. They should match the installed version to Check Point’s listed minimum hotfix take and review the vendor’s advisory for indicators of compromise. A patch closes the identified vulnerability, but it does not by itself establish that an already exposed device has no back door or other persistence.
U.S. federal agencies faced a CISA deadline of November 16, 2026, to address CVE-2026-123039 under the agency’s exploited-vulnerabilities catalog process. Other organizations should follow applicable vendor and national cybersecurity guidance, especially if they run unsupported versions. Further public reporting from Check Point or security agencies may clarify attribution, the scope of the attacks, and whether additional destructive cases were identified.
Key Questions
What happened to Check Point Security Gateways?
Check Point says attackers exploited PHP2Shell flaws through Mobile Access portals on unpatched gateways, then used a separate flaw to gain root access. Some incidents included a back door and a later move to VMware ESXi servers.
Was a wiper used in every incident?
No. Check Point reported that a wiper called destroy_v6 was used in some cases in the first wave targeting Israeli organizations. It said it found no evidence of destructive activity in a second wave across multiple countries.
What should Check Point customers do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Check exposed systems for the indicators listed in Check Point’s advisory; older, unsupported versions require particular attention.
Who was behind the attacks?
Attribution remains unresolved. Check Point has not identified the operators with confidence. A connection between the back door’s malware family and a China-nexus group does not prove that group carried out these incidents.
Source: ThorstenMeyerAI.com
