TL;DR
Check Point says attackers used PHP2Shell and a separate root-access flaw to compromise a small number of unpatched Security Gateways between Oct. 30 and Nov. 4, 2026. The company advises installing its November Jumbo Hotfix and checking exposed systems for signs of compromise; some victims in the first wave faced destructive activity. Attribution remains uncertain.
Check Point says attackers compromised unpatched Security Gateways from Oct. 30 to Nov. 4, 2026, using PHP2Shell flaws and a separate vulnerability to gain root access. The company’s November Jumbo Hotfix addresses the flaws, while CISA’s Nov. 13 addition of the root-access vulnerability to its exploited-vulnerabilities catalog gave U.S. federal agencies until Nov. 16 to act.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Check Point’s investigation says the attackers entered through internet-facing Mobile Access portals on gateways that had not received the available PHP2Shell fix. The two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enabled code execution through the portal. Attackers then used CVE-2026-123039, a separate flaw in DynamicCLI, to obtain root privileges. Check Point says it disclosed that root-access flaw and released its fix on Nov. 12.
Check Point reported that only a couple of dozen unpatched systems in one region were compromised in the incidents it observed. In the first wave, targeting Israeli organizations, attackers in some cases moved from a gateway to a VMware ESXi host and ran a wiper named destroy_v6. Check Point says the malware overwrites files with zeros and deletes them. A second wave on Nov. 2 targeted organizations in several countries, with no evidence of destructive activity, according to the company.
Check Point recommends installing the November Jumbo Hotfix on Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and inspecting exposed gateways for the compromise indicators in its advisories. The stated minimum hotfix takes are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82, and Take 174 for R81.20. Check Point says versions R81.10 and older are past end of support.
Protecting Gateways and Virtual Servers
A compromised gateway can give an intruder a foothold at the boundary between the internet and an organization’s internal network. In these incidents, Check Point says attackers used that access to map internal systems and, in some cases, reach VMware ESXi servers. The reported wiper activity means the consequences for affected organizations could include data loss and disruption, beyond the initial gateway compromise.
The case also involves two points in the patch timeline. Check Point says the gateway hotfix for PHP2Shell was available on Oct. 23, before the reported attacks began, while the fix for CVE-2026-123039 was released Nov. 12. Administrators need to address both vulnerabilities and investigate exposed systems, since installing a fix alone cannot establish whether an attacker had already gained access.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
As an affiliate, we earn on qualifying purchases.
Two Flaws, Separate Fix Dates
PHP2Shell refers to two critical PHP vulnerabilities. The PHP project released fixes on Oct. 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. CISA describes the flaws as allowing unauthenticated remote code execution and added them to its Known Exploited Vulnerabilities catalog on Oct. 26. Check Point says its gateway fix for PHP2Shell followed on Oct. 23.
The attack path described by Check Point involved more than PHP2Shell: attackers used CVE-2026-123039 to move from code execution to root access, then installed back-door components and conducted reconnaissance. Check Point published its investigation and related advisories on Nov. 12. CISA added the root-access flaw to its catalog the next day, setting Nov. 16 as the deadline for U.S. federal agencies to remediate it.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Exposure Remain Open
Who carried out the operation remains unclear. Check Point says the evidence does not support a high-confidence attribution. The back door belongs to a malware family that ESET has linked to a China-nexus group, but Check Point says the destructive activity against Israeli organizations does not fit that group’s known interests.
The company’s account covers the systems and activity it observed. It is not clear from the source material whether other organizations were compromised, whether all affected systems have been identified, or how many victims experienced data loss. Check Point also has not attributed the attacks with confidence, and the available reporting does not establish the full impact of the second wave.
Patch, Then Investigate Exposed Gateways
Administrators should install the applicable November Jumbo Hotfix on all Check Point Management Servers and Security Gateways, starting with internet-facing Mobile Access portals. They should then review exposed systems using the indicators in Check Point’s advisories and investigate for signs of persistence or lateral movement. Organizations running R81.10 or older should account for those versions’ end-of-support status when addressing exposure.
U.S. federal agencies faced a Nov. 16, 2026 remediation deadline for CVE-2026-123039 under CISA’s catalog action. Further information may clarify the number of victims and the scope of damage, but Check Point’s source material does not provide a date for additional findings.
Key Questions
Which Check Point versions have a listed minimum hotfix take?
Check Point lists Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82, and Take 174 for R81.20 as minimum takes for the November Jumbo Hotfix.
Did every compromised gateway lead to a wiper attack?
No. Check Point says wiper activity occurred in some cases in the first wave. It reported no evidence of destructive activity in the second wave.
When did the reported attacks take place?
Check Point says the incidents it investigated ran from Oct. 30 through Nov. 4, 2026.
Has Check Point identified who was behind the attacks?
No. Check Point says it cannot assess the operation’s nature with high confidence. ESET has linked the back-door malware family to a China-nexus group, but that link does not establish who conducted these attacks.
Is installing the hotfix enough if a gateway was exposed?
Check Point recommends installing the hotfix and checking exposed gateways for signs of compromise. Applying the fix addresses the vulnerabilities, but does not by itself determine whether an attacker previously accessed a system.
Source: Thorsten Meyer AI
