🔍 Read the full analysis: PHP2Shell, Check Point Gateways, And The Wiper Malware Threat on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell flaws and a separate root-access vulnerability. Some attacks against Israeli organizations moved to VMware ESXi servers and deployed a wiper; a later wave showed no evidence of destructive activity. CISA added the root flaw to its exploited-vulnerabilities catalog and set a November 16 deadline for U.S. federal agencies.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, using PHP2Shell vulnerabilities to gain access and a separate flaw to obtain root privileges. In some incidents targeting Israeli organizations, the attackers moved to VMware ESXi servers and ran a wiper that destroys data; Check Point reported no evidence of destructive activity in a second wave. The disclosures matter because the attacks used a root-access flaw that had no public fix until November 12, and CISA has directed U.S. federal agencies to address it by November 16.
Check Point published its investigation, an advisory and fixes on November 12. The company said the observed attacks ran from October 30 through November 4 and that only a couple of dozen unpatched systems in one region were compromised in the incidents it investigated. The source material does not identify the region for that count. Check Point said it has not attributed the operation with confidence.
The initial access involved two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Attackers reached them through the gateways’ Mobile Access portal. Check Point says the intruders then exploited CVE-2026-123039 to gain root access on the appliance. The company describes that second flaw as a weakness in a Gaia operating-system helper service; exploiting it required code execution on the gateway first.
In the first wave, which Check Point says targeted Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi host and launched a wiper named destroy_v6. The malware overwrites files with zeros and then deletes them, according to the source material. Its note, DREAM_ANNEXATION.txt, rejects ransom negotiations. A second wave on November 2 targeted organizations in multiple countries, but Check Point said it found no evidence of destructive activity in those incidents.
Check Point said a PHP2Shell hotfix for its gateways was available on October 23, before the reported attacks began. The root-access flaw was disclosed and fixed in the November Jumbo Hotfix on November 12. The vendor recommends applying that update to Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Listed minimum releases include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Check Point says R81.10 and older versions are out of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Gateway Access Led to Destructive Attacks
The incident shows how a flaw exposed through a network appliance’s web portal can become a route to broader access. According to Check Point’s account, PHP2Shell provided code execution with limited privileges, while the separate root-access flaw let attackers take control of the gateway. From there, some intruders reached ESXi infrastructure and ran software designed to erase data.
That sequence makes patching and investigation relevant beyond the gateway itself. Organizations that exposed Mobile Access portals may need to check both the appliance and connected systems for signs of compromise. The reported wiper activity also differs from a typical financially motivated ransomware incident: the note described in the source material rejects ransom negotiations. That detail does not establish the attackers’ motive.
The scope Check Point reported is limited to the cases it investigated: a couple of dozen unpatched systems in one region. It should not be read as a count of all exposed or potentially vulnerable devices. CISA’s November 16 deadline applies to U.S. federal agencies; other organizations are not covered by that federal directive, though the vendor has advised customers to install the hotfix.
Products Worth Considering
Canon SELPHY CP1500 Compact Photo Printer Bundle with Ink and Paper Set, White
HP OfficeJet 250 Wireless Mobile All-in-One Inkjet Printer
LG 27US500-W 27-Inch 4K UHD IPS Monitor
As an affiliate, we earn on qualifying purchases.
Two Flaws Enabled the Intrusion
PHP2Shell refers to two critical PHP vulnerabilities that can allow unauthenticated remote code execution. The PHP project issued fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, according to the source material. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. PHP can be bundled inside other products, so updating the programming language itself may not update an appliance; customers often depend on the device maker’s own software release.
Check Point’s reported chain had two stages: PHP2Shell enabled initial code execution through the Mobile Access portal, and CVE-2026-123039 enabled escalation to root. Check Point rates the root flaw 7.8 out of 10 and says an attacker must already have local code execution to exploit it. CISA added that vulnerability to its exploited-vulnerabilities catalog on November 13, giving U.S. federal agencies until November 16 to act.
Check Point’s account says attackers placed web shells in a directory used by the Mobile Access portal and installed a back door called TSGA, designed to persist after a restart. The available source material does not provide a complete technical account of every observed action, so those details should be treated as the vendor’s description of its investigation rather than a universal account of all intrusions.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Exposure Remain Open
Who carried out the operation remains unconfirmed. The source material says ESET linked the TSGA back-door family to a China-nexus group, but also notes that the destructive attacks focused on Israel do not fit that group’s known interests. That association is not proof that the group conducted these incidents, and Check Point says its evidence is insufficient for a high-confidence assessment.
The exact number of affected organizations, the full geographic distribution and whether additional victims were missed are not established in the supplied account. Nor does the description of two waves show that every organization targeted in the later wave was compromised. Check Point reported no evidence of destructive activity in that wave, a finding limited to the incidents it examined.
It is also unclear from the source material whether every exposed gateway has been identified or whether further activity continued after November 4. The report describes a back door and wiper in some cases, but does not establish the full extent of any data loss or recovery burden.
Apply the Hotfix and Check Systems
Check Point customers should apply the November Jumbo Hotfix to Management Servers and Security Gateways, starting with internet-facing Mobile Access portals, and confirm that systems meet the vendor’s stated minimum release levels. The company also advises checking exposed gateways for the indicators of compromise in its advisory. Organizations using unsupported R81.10 or older releases should treat the support status as a separate issue and consult Check Point for an upgrade path.
U.S. federal agencies covered by CISA’s directive have a deadline of November 16 to address CVE-2026-123039. The next public developments to watch are any updated vendor indicators, new CISA guidance and further findings on the affected systems or attribution. The supplied material does not say whether Check Point or CISA plans another report by a particular date.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. The source material says they can enable unauthenticated remote code execution and that attackers reached them through Check Point gateways’ Mobile Access portals.
What did the attackers do after entering the gateways?
Check Point says attackers used CVE-2026-123039 to gain root access and installed a back door. In some incidents, they moved to VMware ESXi servers and ran the destroy_v6 wiper; the company reported no evidence of destructive activity in a separate wave.
Which Check Point systems should customers update?
Check Point recommends installing the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. Its listed minimum releases include Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20.
Is the attack attributed to a specific group?
No confident attribution has been made. The source material notes an ESET association between the TSGA back-door family and a China-nexus group, but says the fit with the observed destructive, Israel-focused activity is uncertain. Check Point says the evidence is not enough to assess the operation with high confidence.
What is the November 16 deadline?
CISA added CVE-2026-123039 to its exploited-vulnerabilities catalog on November 13 and gave U.S. federal agencies until November 16 to act. The deadline is for those agencies; Check Point separately recommends that customers install its hotfix.
Source: ThorstenMeyerAI.com
