🔍 Read the full analysis: Which Updates Matter After Check Point Gateway Attacks? on ThorstenMeyerAI.com
TL;DR
Check Point says attackers compromised a couple dozen unpatched Security Gateways between Oct. 30 and Nov. 4, using PHP vulnerabilities and a separate flaw to gain root access. The company’s Nov. 12 Jumbo Hotfix addresses the root flaw, and CISA added it to its exploited-vulnerabilities catalog on Nov. 13 with a Nov. 16 deadline for U.S. federal agencies. The attacker’s identity and the full scope of any effects remain unclear.
CISA added CVE-2026-123039, a root-access flaw in Check Point Security Gateways, to its catalog of exploited vulnerabilities on Nov. 13 and set a Nov. 16 deadline for U.S. federal agencies to address it. Check Point says attackers used the flaw after breaking into unpatched gateways between Oct. 30 and Nov. 4; the company’s November Jumbo Hotfix contains the fix.
Check Point’s investigation, published Nov. 12, describes an attack chain that began through the gateways’ Mobile Access portal. Attackers exploited two critical PHP vulnerabilities, known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to run code on unpatched appliances. They then used CVE-2026-123039 to escalate from limited access to root, the system’s highest-privilege account.
Check Point said “only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.” It reported two waves: an initial campaign targeting Israeli organizations and a second wave on Nov. 2 aimed at organizations in multiple countries. The company said it found no evidence of destructive activity in the second wave.
In some incidents in the first wave, Check Point said, attackers moved from a gateway to a VMware ESXi server and ran a wiper called destroy_v6. The program overwrites files with zeros and then deletes them, according to the source report. A note left by the malware, DREAM_ANNEXATION.txt, explicitly rejects ransom negotiations. The available information does not establish how many organizations or systems were affected by this destructive activity.
Check Point says a PHP2Shell hotfix for its gateways was available on Oct. 23, before the reported attacks began. The root-access flaw was different: Check Point disclosed it and released its fix in the Nov. 12 Jumbo Hotfix. The company advises installing that update on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals.
The listed minimum update levels are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point also advises checking exposed gateways for indicators of compromise listed in its advisory. The source says R81.10 and older versions are past end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, „PHP2Shell Exploitation on Check Point Gateway“, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Patching Is Urgent
The incidents show how a flaw in a network appliance can become a route to broader access inside an organization. In the chain described by Check Point, the PHP vulnerabilities provided code execution through an exposed portal, while the separate root-access flaw turned that foothold into full control of the gateway. An attacker with that level of access may be positioned to maintain access or reach other systems, as Check Point reported in some cases.
The risk is not limited to the reported victim count. Check Point’s estimate covers the incidents it observed; it does not establish the total number of vulnerable devices or rule out other activity. CISA’s catalog entry and short federal deadline make the issue a priority for affected U.S. agencies, while other organizations using exposed gateways also have reason to apply the vendor’s updates and examine systems for compromise.
The destructive activity adds a separate operational concern. A wiper can make systems and data unavailable rather than simply seek payment, but Check Point’s account confines that behavior to some incidents in the first wave. The company reported no evidence of destructive activity in the second wave, so the two campaigns should not be treated as having the same observed impact.
Popular right now
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Milk Frother, Silver
Vitamix 5200 Blender with 64 oz Container, Black
Dyson V9 Motorbar Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
From PHP Flaws to Root Access
PHP2Shell refers to two critical flaws in PHP that can permit unauthenticated remote code execution. The PHP project fixed them on Oct. 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, according to the source material. CISA added the PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 26. Security appliances may include PHP as part of their own web interfaces, so users generally depend on the device manufacturer to distribute an appliance-specific update.
For the Check Point attacks, the PHP flaws were the initial route in, while CVE-2026-123039 was a separate local privilege-escalation flaw. Check Point rates the latter 7.8 out of 10 and says an attacker must already have local code execution on the appliance. Its report says a Gaia operating-system helper service called DynamicCLI runs as root and accepts commands through a local socket without checking the caller. That weakness could let an attacker who had already gained code execution obtain root privileges.
Check Point reported that attackers used root access to place web shells in a directory used by the Mobile Access portal and to install a back door called TSGA. The source material says the back door renames itself and is configured to persist after a restart. These details describe the chain reported by the vendor; they do not by themselves identify who operated it.
„“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”“
— Check Point
Attribution and Impact Still Open
Who carried out the attacks remains unknown. The source material says the back door belongs to a malware family that ESET has linked to a China-nexus group, but that association does not establish who was responsible for these incidents. Check Point said the evidence was insufficient to assess the operation’s nature with high confidence and has not attributed the attacks confidently.
The exact scale also remains unsettled. Check Point reported a couple of dozen compromised unpatched systems in one region, but the source does not give a complete count of affected organizations, the number of systems exposed but not compromised, or the full extent of any damage. It is also unclear from the available material how many systems experienced the reported wiper activity or whether additional victims have since been identified.
Check Point’s report describes indicators and attack behavior observed in its investigation. The source material does not provide independent confirmation of every reported step, nor does it say whether the attackers retained access to systems after the fixes became available. The vendor’s stated absence of destructive evidence in the second wave should not be read as proof that no other effects occurred.
Apply Fixes and Check Gateways
U.S. federal agencies covered by the CISA directive must act by Nov. 16, according to the catalog update described in the source material. Organizations running Check Point appliances should apply the November Jumbo Hotfix at the applicable supported release level, giving internet-facing Mobile Access portals priority. Patching addresses the identified vulnerability, but organizations should also follow Check Point’s advice to inspect previously exposed gateways for the indicators listed in its advisory.
Security teams should establish which gateway and Management Server versions they operate, verify that the update is installed, and review available logs and systems for signs of unauthorized access. Where an appliance is on an unsupported release, the source advises treating that support status as a separate concern; it does not provide a specific upgrade path for every deployment. Organizations should consult Check Point’s current advisory for product-specific instructions and indicators.
Further clarity will depend on updates from Check Point, CISA and affected organizations, including any additional confirmed victims, evidence of later activity, or stronger attribution. Until then, the reported victim count and campaign description should be treated as the findings available from Check Point’s investigation, not a complete accounting of all possible exposure.
Key Questions
What did CISA do on Nov. 13?
CISA added CVE-2026-123039, the Check Point gateway root-access flaw, to its catalog of exploited vulnerabilities. The source says it set a Nov. 16 deadline for U.S. federal agencies to act.
Which Check Point update addresses the root flaw?
Check Point says the fix is in its November Jumbo Hotfix. The minimum listed take levels are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Administrators should confirm the right update for their deployment against Check Point’s advisory.
How did attackers get into the gateways?
Check Point says attackers used two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, through the Mobile Access portal. They then used CVE-2026-123039 to gain root access.
Were all targeted organizations hit by a wiper?
No. Check Point reported wiper activity in some cases in the first wave, which targeted Israeli organizations. It said there was no evidence of destructive activity in the second wave on Nov. 2.
Has Check Point identified the attackers?
No confident attribution has been made. The source material notes an association between the back-door malware family and a China-nexus group, but says that link does not establish responsibility for these attacks.
Source: ThorstenMeyerAI.com
