🔍 Read the full analysis: Check Point Gateway Security: Patch Considerations After PHP2Shell on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers exploited unpatched Security Gateways from October 30 to November 4, using PHP2Shell to gain access and a separate flaw to reach root privileges. The company released fixes in its November Jumbo Hotfix on November 12; CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13 and set a November 16 deadline for U.S. federal agencies.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, exploiting PHP2Shell vulnerabilities and a separate flaw to gain root access. The company released fixes in its November Jumbo Hotfix on November 12; the U.S. Cybersecurity and Infrastructure Security Agency added the root-access vulnerability, CVE-2026-123039, to its exploited-vulnerabilities catalog the next day.
Check Point’s November 12 investigation says the attackers entered through exposed Mobile Access portals on gateways that had not received the PHP2Shell fix. The two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enabled remote code execution, according to the vendor’s advisory. After gaining limited execution on an appliance, attackers used CVE-2026-123039 to obtain root privileges on its Gaia operating system.
Check Point said the observed incidents involved a couple of dozen unpatched systems in one region. In an initial wave targeting Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi server and ran a destructive program called destroy_v6. The vendor says the wiper overwrites files with zeros before deleting them. A second wave, on November 2, targeted organizations in multiple countries, with Check Point reporting no evidence of destructive activity in that wave.
The company says the attackers installed web shells and a back door known as TSGA, designed to persist after a restart. Check Point’s recommended action is to install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and then check exposed systems for the indicators in its advisory. The source lists minimum applicable takes: Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. R81.10 and older versions are past end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Exposed Gateways Need Attention
The incident shows how a flaw in a widely used programming language can become a route into a network appliance when that component is embedded in a vendor’s product. Check Point says a PHP2Shell fix for its gateways had been available on October 23, before the observed attacks began, but the separate root-access flaw was not disclosed and fixed until the November 12 Jumbo Hotfix. Applying the PHP fix alone did not address the later privilege-escalation weakness.
Root access can give an intruder extensive control over an appliance that sits at the boundary of an organization’s network. The reported move to ESXi systems and use of a wiper in some incidents adds a potential data-destruction impact beyond gateway access. However, Check Point’s account limits the confirmed scope to a couple of dozen compromised unpatched systems in a single region; it does not establish that all vulnerable gateways were breached.
CISA’s catalog entry makes the issue time-sensitive for U.S. federal agencies, which were given until November 16 to act. Other organizations can use the vendor’s patch and investigation guidance to identify exposure, but the source material does not establish a deadline for them or quantify the total number of affected devices.
Products Worth Considering
LG UltraGear 32GX870A-B 32-Inch 4K OLED Gaming Monitor, Dual Mode 240Hz/480Hz
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Apple MacBook Pro 16-inch (2021), M1 Pro, 10-core CPU, 16-core GPU, 16GB RAM, 512GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
How PHP2Shell Reached Check Point
PHP2Shell refers to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. The PHP project issued fixes on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution and added both to its Known Exploited Vulnerabilities catalog on October 26. Its warning notes that PHP can be embedded in other products, so affected components may not be obvious to users.
Check Point’s advisory says the PHP flaws could allow remote code execution through firewall web interfaces. The vendor says its gateway fix for PHP2Shell was available October 23. The intrusion described in the later investigation used that initial access and then a distinct vulnerability, CVE-2026-123039, in a Gaia helper service called DynamicCLI. Check Point says the service ran as root and accepted commands over a local socket without checking the caller, enabling privilege escalation once attackers already had code execution on the appliance.
The source account says Check Point rated CVE-2026-123039 7.8 out of 10, high severity, and placed its fix in the November Jumbo Hotfix. The sequence matters: the PHP vulnerabilities supplied a way in, while the separate flaw elevated access. The two stages require readers to check that the later hotfix—not just the earlier PHP-related remediation—has been installed.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Scope Remain Open
Who conducted the operation remains unconfirmed. Check Point has not attributed the attacks with confidence. The source material says the back door belongs to a malware family that ESET has linked to a China-nexus group, but it also says the destructive activity targeting Israeli organizations does not fit that group’s known interests. That association is not proof that the group carried out these incidents.
The number of compromises reported by Check Point covers its observed incidents, not necessarily every potentially exposed gateway. The source does not specify how many systems were vulnerable, whether additional victims have been identified, or whether the attackers retained access elsewhere in affected networks. It also does not provide a complete account of recovery or data-loss outcomes.
Check Point reported no evidence of destructive activity in the November 2 wave, but that statement is limited to the activity investigated and described in its report. The available material does not establish whether attacks continued after November 4 or whether all compromised systems have been found.
Patch, Investigate, Track CISA Deadline
Organizations using Check Point gateways should apply the November Jumbo Hotfix to Management Servers and Security Gateways, following the take numbers specified for their software versions. Internet-facing Mobile Access portals should be prioritized. After installation, administrators should review the vendor’s listed indicators on every gateway that was exposed, rather than treating a successful update as proof that no compromise occurred.
U.S. federal agencies were directed to address CVE-2026-123039 by November 16, according to the CISA catalog update described in the source. Administrators also need to account for end-of-support software: the source identifies R81.10 and older as unsupported and does not give a supported hotfix path for those versions.
Further clarity depends on Check Point’s investigation, any additional victim disclosures, and whether the company or authorities publish stronger attribution. The source provides no date for a follow-up report. Until then, the confirmed response is to patch, inspect exposed systems and treat attribution and the wider scope as unresolved.
Key Questions
What happened to Check Point Security Gateways?
Check Point says attackers exploited unpatched gateways from October 30 to November 4, entering through Mobile Access portals and using a second vulnerability to gain root access. In some incidents, they also moved to VMware ESXi systems and ran a wiper.
Which vulnerabilities were involved?
The initial access used PHP2Shell, CVE-2026-109618 and CVE-2026-109619. Attackers then used CVE-2026-123039 to escalate privileges on the Gaia operating system, according to Check Point.
What should Check Point administrators do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritize internet-facing Mobile Access portals, and inspect exposed appliances for the indicators listed in Check Point’s advisory. Use the required take for the installed software version.
Were all attacks destructive?
No. Check Point says destroy_v6 was used in some incidents in the first wave targeting Israeli organizations. The company reported no evidence of destructive activity in the second wave on November 2.
Who was responsible for the attacks?
Check Point has not attributed the operation with high confidence. The source mentions a malware-family link reported by ESET but says the available evidence does not establish who carried out the attacks.
Source: ThorstenMeyerAI.com
