🔍 Read the full analysis: How To Respond To PHP2Shell Attacks On Check Point Gateways on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point says attackers compromised a small number of unpatched Security Gateways from October 30 to November 4, using PHP2Shell flaws and a separate vulnerability to gain root access. The company says to install its November Jumbo Hotfix, prioritize internet-facing Mobile Access portals and investigate exposed systems for compromise. CISA added the root-access flaw to its exploited-vulnerabilities catalog on November 13.
Check Point says attackers compromised unpatched Security Gateways between October 30 and November 4 by exploiting PHP2Shell flaws through the Mobile Access portal, then using a separate vulnerability to gain root access. The company released a fix in its November Jumbo Hotfix on November 12; CISA added the root-access flaw, CVE-2026-123039, to its exploited-vulnerabilities catalog on November 13.
Check Point’s investigation says the observed attacks affected “only a couple of dozen unpatched systems, in a single region.” The intrusions began with PHP2Shell, the name used for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Attackers reached them through exposed Mobile Access portals and obtained code execution under the portal’s service account. They then exploited CVE-2026-123039 to elevate access to root, the appliance’s highest-privilege account.
With root access, the attackers placed web shells in the Mobile Access portal’s page directory and installed a back door that Check Point says could survive a restart. The company reported that, in some incidents in the first wave targeting Israeli organizations, attackers moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6. The program overwrites files with zeros and deletes them. A second wave, dated November 2 and affecting organizations in several countries, had no evidence of destructive activity, according to Check Point.
Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, starting with internet-facing Mobile Access portals, and checking exposed appliances for the indicators in its advisory. Its listed minimum hotfix takes are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. The company says the PHP2Shell gateway hotfix was available on October 23, before the observed attacks began; the fix for the separate root flaw was included in the November release. R81.10 and earlier versions are beyond end of support.
Check Point gateway attacks · Oct 30 – Nov 4, 2026
How the break-in worked, and where the fix cuts it
The attack chain as Check Point describes it, without the technical recipe. One update closes the first two doors.
Path through the network (schematic)
InternetAttacker traffic
Gateway web portalMobile Access
Gateway systemRoot rights
Internal networkScanned from the gateway
VMware ESXi hostRuns virtual machines
normaltaken overwipedclosed by fix
Step by step
- Scanfrom Oct 30Unpatched gateways with an internet-facing Mobile Access portal are probed
- Way inPHP2Shell (CVE-2026-109618, CVE-2026-109619) runs code as the portal’s service account closed by fix
- RootCVE-2026-123039 in DynamicCLI turns that into full root rights closed by fix
- Back doorWeb shells in the portal’s login-page folder; TSGA back door with TSProxy hidden in appliance processes
- ReconThe gogo scanner maps internal systems from the gateway
- WipeSSH to a VMware ESXi host, destroy_v6 wiper, a note that rejects ransom talk (first wave, some victims)
R82.20 from Take 14 · R82.10 from Take 52 · R82 from Take 132 · R81.20 from Take 174. It closes both PHP2Shell and CVE-2026-123039. Then check for signs of compromise.
Sources: Check Point Research, “PHP2Shell Exploitation on Check Point Gateway”, and Check Point advisories sk1000302 and sk1000362, Nov 12, 2026. Schematic of the attack path described by Check Point, not a map of any victim’s network.
Graphic: Powered by Thorsten Meyer AI
Root Access Raises the Stakes
The incident shows how a flaw in a device’s web-facing service can become a route to full control of a security gateway. In this case, the PHP vulnerabilities provided initial code execution, while a separate weakness in Gaia’s DynamicCLI service allowed an attacker already on the appliance to run commands as root. Check Point says that service ran as root and accepted requests through a locally accessible socket without verifying the caller.
A compromised gateway can expose a foothold into the wider network. Check Point’s account that attackers reached an ESXi host and ran a wiper in some first-wave incidents makes investigation of connected infrastructure relevant, not just patching the appliance. The company has not said that every affected organization experienced data destruction, and it reported no evidence of destructive activity in the second wave.
The episode also highlights a patching challenge for appliances: PHP may be embedded in a vendor’s product, so applying a general PHP update is not necessarily the same as fixing the device. Administrators need the manufacturer’s supported update and must account for both the initial-access flaws and the later root-access vulnerability.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
LG UltraGear 24-Inch Full HD IPS Gaming Monitor, 120Hz (144Hz Overclocked), 1ms MBR, G-SYNC Compatible, FreeSync, HDR10
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
Two Flaws, Two Patch Timelines
PHP2Shell refers to two critical vulnerabilities in PHP. The PHP project issued fixes on October 21 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Each flaw has a CVSS severity score of 9.2 out of 10. CISA describes them as enabling unauthenticated remote code execution, meaning an attacker may run commands without first logging in. CISA added both to its Known Exploited Vulnerabilities catalog on October 26.
Those PHP fixes did not, by themselves, establish that every product containing PHP had been patched. Check Point’s advisory said the flaws could allow remote code execution through firewall web interfaces. The vendor says a gateway hotfix for PHP2Shell was available October 23, while CVE-2026-123039 was disclosed and fixed in its November Jumbo Hotfix on November 12. CISA’s November 16 deadline for U.S. federal agencies applies to the root-access flaw’s catalog entry; it is not a deadline for all organizations.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Scope Remain Open
The attacker’s identity and motive remain unconfirmed. Check Point said the evidence does not support a high-confidence assessment. The back door is from a malware family that ESET has linked to a China-nexus group, but the source material says the destructive, Israel-focused activity does not fit that group’s known interests. That mismatch is not proof for or against attribution.
The reported count covers systems compromised in the incidents Check Point observed. The available account does not establish how many other organizations were targeted, whether every exposed gateway was affected, or whether additional intrusions went undetected. Check Point’s report also distinguishes the first wave, where it found destructive activity in some cases, from the second wave, where it said it found none; the full extent of impact across affected organizations is not specified.
Patch, Investigate, and Report
Organizations using Check Point Management Servers or Security Gateways should apply the applicable November Jumbo Hotfix and confirm that the installed take meets the vendor’s listed minimum. Internet-facing Mobile Access portals are the stated priority. Administrators should also review Check Point’s advisory for indicators of compromise, examine exposed systems and connected infrastructure, and follow their incident-response procedures if they find suspicious activity.
U.S. federal agencies are subject to CISA’s November 16, 2026, deadline to address CVE-2026-123039 under the agency’s catalog process. Further reporting may clarify the number of affected organizations, the extent of any data loss and whether investigators can attribute the operation. Until then, Check Point’s findings and its patch guidance are the available basis for response.
Key Questions
What is PHP2Shell in this incident?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Check Point says attackers reached them through gateways’ Mobile Access portals to obtain initial code execution.
Which Check Point update should administrators install?
Check Point recommends the November Jumbo Hotfix for all Management Servers and Security Gateways. Its listed minimum takes are Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82 and Take 174 on R81.20. Confirm the correct update for each deployment against Check Point’s advisory.
Did the attacks destroy data in every case?
No. Check Point reported that attackers ran a wiper on some ESXi hosts during the first wave. It said the second wave had no evidence of destructive activity; the source does not say that all first-wave victims experienced data destruction.
Has Check Point identified who carried out the attacks?
No. Check Point said it could not assess the operation’s nature with high confidence. A malware-family link reported by ESET is not, on its own, confirmation of who conducted this campaign.
Source: ThorstenMeyerAI.com
