🔍 Read the full analysis: How Attackers Target Check Point Gateways And Where To Patch on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers used flaws in unpatched Security Gateways between October 30 and November 4, in some cases gaining root access and deploying a back door. The company’s November Jumbo Hotfix addresses the issues; CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13 and set a November 16 deadline for U.S. federal agencies.
Check Point says attackers compromised unpatched Security Gateways from October 30 through November 4 by exploiting flaws exposed through the Mobile Access portal, then used a separate vulnerability to gain root access. The company released fixes in its November Jumbo Hotfix on November 12; CISA added the root-access flaw, CVE-2026-123039, to its exploited-vulnerabilities catalog on November 13, giving U.S. federal agencies until November 16 to act.
Check Point’s November 12 investigation describes two attack waves. The first targeted organizations in Israel; in some cases, attackers moved from a compromised gateway to a VMware ESXi server and ran a data-wiping program called destroy_v6. The program overwrites files with zeros and then deletes them. A note left by the malware, DREAM_ANNEXATION.txt, rejects ransom negotiations, according to the company.
A second wave began on November 2 and affected organizations in multiple countries. Check Point reported no evidence of destructive activity in that wave. The company said only “a couple of dozen unpatched systems, in a single region,” were compromised in the incidents it observed. That is the vendor’s estimate of cases it investigated, not a measure of all potentially exposed systems.
The initial route in was PHP2Shell, the name for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. They could allow remote code execution through the gateways’ Mobile Access web interface. Check Point says a hotfix addressing PHP2Shell on its gateways was available October 23, a week before the observed attacks began. Attackers who obtained limited code execution then exploited CVE-2026-123039 to reach root, the appliance’s highest-privilege account.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Why Gateway Patching Matters
Security Gateways sit between an organization’s network and outside connections, so a compromised appliance can give attackers a foothold in systems behind it. In the incidents Check Point described, the risk extended beyond the gateway: attackers gained root access and, in some cases, reached an ESXi server and ran a wiper. That makes the report relevant to organizations using the affected products, especially those with internet-facing Mobile Access portals.
The incident also shows why applying a fix for one vulnerability may not be enough when attackers can chain flaws. The PHP2Shell issues provided a way to run code on the appliance, while CVE-2026-123039 allowed that code to escalate to root. Check Point’s advisory says the root flaw requires local code execution, a condition the earlier vulnerabilities could supply. Administrators should therefore install the current hotfix and examine exposed gateways for signs of compromise, rather than treating patching alone as proof that an intrusion did not occur.
CISA’s November 16 deadline applies to U.S. federal agencies, not all organizations. Other operators do not share that stated deadline, but the observed attacks and the vendor’s remediation guidance make the update relevant to any organization running affected Check Point systems.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Dell UltraSharp U4025QW 40-Inch Curved 5K2K WUHD LED Monitor
LG UltraGear 32GS60QC-B 32-inch QHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Exploit Chain Worked
PHP is used within software and network appliances to power web features. The PHP project fixed the two PHP2Shell flaws on October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes them as allowing unauthenticated remote code execution in PHP and added them to its Known Exploited Vulnerabilities catalog on October 26. A PHP update does not necessarily reach an appliance automatically: the device maker may need to incorporate and distribute the fix in its own software.
For Check Point gateways, the public-facing route was the Mobile Access portal. Check Point says it found PHP session files carrying a marker associated with exploitation and hundreds of segmentation faults in the portal’s web workers, which it interpreted as evidence of repeated attempts. Once attackers had code running as the portal service account, they used the separate root flaw in the Gaia operating system. Check Point describes DynamicCLI as a helper service that ran as root and listened on a world-writable local socket without checking the identity of the process communicating with it.
After gaining root, attackers placed PHP web shells in a directory used by the Mobile Access portal and deployed a back door Check Point identified as TSGA. The company says the back door renames itself and is configured to persist after a restart. The root vulnerability is rated 7.8 out of 10 by Check Point and is distinct from the two critical PHP flaws.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Exposure Remain Open
Who carried out the attacks remains unconfirmed. Check Point says it cannot assess the operation’s nature with high confidence. The back door belongs to a malware family that ESET has linked to a China-nexus group, but the source material says the destructive activity targeting Israeli organizations does not fit that group’s known interests. That connection is not proof of responsibility.
The reported count is limited to the systems Check Point observed and investigated. The available information does not establish how many gateways were vulnerable or exposed overall, whether every affected organization has identified all compromised devices, or whether additional victims will be reported. Check Point’s account also distinguishes the destructive first wave from the second wave, for which it found no evidence of destructive activity; that finding should not be read as proof that no other activity occurred.
The source material does not provide a complete list of compromise indicators or specify the full scope of recovery actions for affected organizations. Operators should consult Check Point’s advisory and investigation for the vendor’s current technical guidance.
Apply the Hotfix and Investigate
Check Point recommends installing its November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The listed minimum takes are Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Administrators should confirm the correct release and take for each device against the company’s advisory before deployment.
After patching, organizations should check every gateway that was exposed for the compromise indicators Check Point lists. The source material says R81.10 and older versions are past end of support, so operators on those releases should consult the vendor’s guidance on supported remediation and upgrade options rather than assume the listed hotfix applies.
U.S. federal agencies face CISA’s November 16, 2026, deadline for the cataloged root-access flaw. Further reporting may clarify the scale of exposure, the response by affected organizations and whether investigators can attribute the operation. Until then, Check Point’s confirmed account supports two immediate steps: install the relevant hotfix and investigate potentially exposed gateways for compromise.
Key Questions
Which Check Point systems should be patched?
Check Point recommends the November Jumbo Hotfix for all Management Servers and Security Gateways, with internet-facing Mobile Access portals prioritized. Check the vendor’s advisory for the applicable release and minimum take.
What hotfix takes are listed?
The source lists Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Administrators should verify applicability in Check Point’s current advisory before installing.
What did attackers do after entering a gateway?
Check Point says attackers used a second flaw to gain root access, placed web shells and deployed a persistent back door. In some first-wave incidents, they moved to a VMware ESXi host and ran a wiper.
Has Check Point identified who was responsible?
No. Check Point says it cannot assess the operation’s nature with high confidence. A malware-family link reported by ESET is not confirmation that the linked group carried out these attacks.
Who has a November 16 deadline?
CISA gave U.S. federal agencies until November 16, 2026, to act on the root-access flaw, CVE-2026-123039. The source does not state that this deadline applies to other organizations.
Source: ThorstenMeyerAI.com
