🔍 Read the full analysis: What Is The PHP2Shell-to-Wiper Path On Check Point Gateways? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Check Point says attackers exploited PHP2Shell flaws in unpatched Security Gateways from October 30 to November 4, then used a separate flaw to gain root access. Some intrusions involved a wiper on VMware ESXi systems; the company reported no destructive activity in a second wave. Check Point says fixes are in its November Jumbo Hotfix, while the attackers’ identity remains unconfirmed.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4, using PHP2Shell vulnerabilities to enter through Mobile Access portals and a separate flaw to gain root access. In some cases, the attackers moved from gateways to VMware ESXi servers and ran a data-wiping program; Check Point reported no evidence of destructive activity in a second wave. The disclosure matters because the intrusions combined remote access with a previously undisclosed privilege-escalation flaw, and the attackers have not been confidently identified.
Check Point Research said the intrusions began October 30 and targeted gateways whose Mobile Access portals had not been protected against PHP2Shell, the name used for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. The vulnerabilities could let an unauthenticated attacker run code through a vulnerable web interface. Check Point says the first wave targeted Israeli organizations. In some cases, attackers then reached VMware ESXi hosts and ran a wiper named destroy_v6, which overwrites files with zeros before deleting them. A note left by the program, DREAM_ANNEXATION.txt, rejected ransom negotiations, according to the investigation.
A second wave on November 2 targeted organizations in multiple countries. Check Point reported no evidence of destructive activity in that wave. The company said only a couple of dozen unpatched systems in a single region were compromised in the incidents it observed; it did not describe that figure as a count of all systems targeted or all possible compromises.
After gaining code execution as a limited service account, attackers used CVE-2026-123039 to obtain root privileges on the gateway. Check Point described the flaw in a Gaia helper service called DynamicCLI. The company published its investigation, advisory and a fix in its November Jumbo Hotfix on November 12. It says an earlier fix for PHP2Shell on its gateways had been available October 23, before the observed attacks began; the root-access flaw was disclosed and fixed on November 12.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
How Gateway Access Reached ESXi
The incidents show how a vulnerable internet-facing gateway can become a route into systems beyond the appliance itself. In this case, Check Point says the attackers chained remote code execution with a separate flaw that elevated their access to root, then used that position to install a persistent back door. Some activity proceeded from the gateway to an ESXi host, where the wiper could affect data and services running on that infrastructure.
The reported destructive activity is narrower than the full set of attacks: Check Point says it occurred in some cases during the first, Israel-focused wave, while it found no evidence of wiping in the second wave. That distinction matters for organizations determining whether they face a risk of data loss or evidence of a foothold that requires investigation. The report does not establish that every compromised gateway led to an ESXi intrusion.
For defenders, the disclosure also highlights a patching gap across appliance software. PHP may be bundled inside a network product, so updating PHP itself is not necessarily enough; customers may need the vendor’s appliance-specific update. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13 and set a November 16 deadline for U.S. federal agencies to address it.
Products Worth Considering
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Samsung Galaxy Tab A11+ Kids Edition, 128 GB Android Tablet, Royal Blue
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
Two Flaws, Separate Fix Timelines
The PHP project fixed the two PHP2Shell vulnerabilities on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Each flaw has a reported CVSS score of 9.2 out of 10. CISA described them as permitting unauthenticated remote code execution and added both to its exploited-vulnerabilities catalog on October 26. The PHP fixes did not automatically update software embedded in network appliances; product vendors had to provide their own updates.
Check Point’s account separates the initial access issue from the later root-access vulnerability. The vendor says a PHP2Shell hotfix for its gateways was available October 23, while CVE-2026-123039 remained undisclosed until November 12. Check Point rates the latter 7.8 out of 10 and says exploitation requires local code execution on the appliance, which PHP2Shell could provide. The chain therefore depended on both an entry point and a way to elevate privileges.
Check Point’s investigation also describes persistent access through web shells placed in the Mobile Access portal’s login-page directory and a back door called TSGA, which it says was designed to survive a restart. These details support the vendor’s account of persistence; they do not independently establish who operated the intrusion.
“Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.”
— Check Point
Attribution and Full Impact Remain Open
Who carried out the attacks is unknown. Check Point said its evidence does not support a high-confidence assessment of the operation’s nature. The back door is associated with a malware family that ESET has linked to a China-nexus group, but the source material says the Israel-focused destructive activity does not fit that group’s known interests. That association is not proof that the group was responsible.
The available account also does not establish the full number of affected organizations, how many gateways were reached but not compromised, or how many ESXi systems were damaged. Check Point’s estimate covers the systems it observed in the investigated incidents. Details about the extent of data loss, recovery and any effects beyond the reported cases have not been provided here.
It is also not clear whether other actors used the flaws against Check Point products or whether every exposed device received the relevant hotfix. Organizations will need to assess their own gateway logs and systems against the indicators in Check Point’s advisory rather than assume that applying a patch alone resolves earlier compromise.
Patch, Then Check for Intrusions
Check Point advises customers to install the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals. The supplied minimum takes are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Administrators should confirm the appropriate update for their deployment in the vendor’s advisory.
After patching, organizations should review every gateway that was exposed for the compromise indicators Check Point lists. The investigation describes web shells, unusual portal activity and persistence mechanisms; checking for those signs matters because an update does not by itself remove an attacker who entered before the fix. Check Point says R81.10 and older releases are past end of support, so operators of those versions should consult the vendor about supported remediation.
U.S. federal agencies face a CISA deadline of November 16, 2026, to address CVE-2026-123039. Further details may emerge as affected organizations investigate and vendors and authorities publish updates. The source material does not identify a confirmed attacker or set out a final account of the incidents’ overall impact.
Key Questions
What does PHP2Shell mean in this incident?
PHP2Shell refers here to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Check Point says attackers used them through unpatched Mobile Access portals to run code on affected gateways without first logging in.
What was the gateway root-access flaw?
CVE-2026-123039 was a separate vulnerability in Check Point’s Gaia operating system. According to Check Point, attackers who already had local code execution could use it to elevate their access to root, the system’s most privileged account.
Did every attack involve a wiper?
No. Check Point says the destroy_v6 wiper was used in some cases during the first wave targeting Israeli organizations. The company reported no evidence of destructive activity in a second wave that began November 2.
Who was responsible?
The attacks have not been confidently attributed. Check Point noted a link between the back-door malware family and a group ESET has associated with China, but said the available evidence did not support a high-confidence conclusion about the operation.
What should Check Point customers do?
Install the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, then check previously exposed gateways for the indicators in Check Point’s advisory. Customers on R81.10 or older should note that those releases are past end of support.
Source: ThorstenMeyerAI.com
