TL;DR
Check Point says attackers used PHP2Shell vulnerabilities and a separate root-access flaw to compromise a small number of unpatched Security Gateways between October 30 and November 4, 2026. It says the November Jumbo Hotfix fixes both issues; CISA added the root flaw to its exploited-vulnerability catalog on November 13 and set a November 16 deadline for US federal agencies.
Check Point says attackers compromised unpatched Security Gateways from October 30 through November 4, using two PHP2Shell flaws and a separate vulnerability that gave them root access. The company’s November Jumbo Hotfix addresses both attack paths, while CISA’s November 13 listing of the root flaw gives US federal agencies until November 16 to take action.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Check Point’s investigation says the attackers reached gateways through the Mobile Access portal. They exploited PHP flaws CVE-2026-109618 and CVE-2026-109619 to run code, then used CVE-2026-123039, a separate vulnerability in DynamicCLI, to obtain root privileges. Check Point says the PHP2Shell gateway hotfix had been available since October 23, before the observed attacks began. It disclosed the root flaw and released its fix on November 12.
The company said it observed compromises on “only a couple of dozen unpatched systems, in a single region.” It described a first wave targeting Israeli organizations. In some cases, attackers moved from a gateway to a VMware ESXi host and ran a wiper called destroy_v6, which overwrites files with zeros and deletes them. A second wave on November 2 targeted organizations in multiple countries; Check Point said it found no evidence of destructive activity in that wave.
Check Point recommends installing the November Jumbo Hotfix on all Management Servers and Security Gateways, prioritizing internet-facing Mobile Access portals, and checking exposed gateways for the indicators in its advisories. The minimum listed releases are Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point says R81.10 and older versions are past end of support.
Closing Both Gateway Entry Points
These attacks show why patching the initial web-facing flaw alone may not be enough when attackers can use another weakness to gain broader control. Check Point says the November hotfix addresses both PHP2Shell and the root-access vulnerability, so applying the release and reviewing exposed systems are separate parts of responding to this incident.
The reported use of a wiper raises the stakes for organizations whose virtual machines depend on an affected gateway for access. Check Point reported destructive activity only in some cases in the first wave and said it had no evidence of such activity in the second. The scope it reported—dozens of systems in one region—describes its observed incidents, not necessarily every attempted or undetected intrusion.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Trezor Safe 7 Crypto Hardware Wallet with Bluetooth and Color Touchscreen
Ledger Nano Gen5 Crypto Wallet with Touchscreen, Black
As an affiliate, we earn on qualifying purchases.
Two Flaws, Two Patch Dates
The PHP project fixed PHP2Shell in releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, according to the source material. Each flaw has a reported CVSS score of 9.2 out of 10. CISA added both to its Known Exploited Vulnerabilities catalog on October 26 and described them as allowing unauthenticated remote code execution in PHP.
Check Point says its gateway hotfix for PHP2Shell was available October 23. The separate CVE-2026-123039 issue was fixed in the November Jumbo Hotfix published November 12. CISA added that root-access flaw to its catalog on November 13, with a November 16 deadline for US federal agencies. These dates distinguish the already available PHP-related fix from the later fix addressing root access.
““Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents.””
— Check Point
Attribution and Full Scope
Who carried out the attacks remains uncertain. The source material says the back door belongs to a malware family ESET has linked to a China-nexus group, but Check Point said the evidence does not support a high-confidence assessment of the operation. The reported Israeli targeting and destructive activity do not, on their own, establish who was responsible.
Check Point’s account also does not establish the total number of affected organizations or whether every exposed gateway was detected. Its “couple of dozen” figure refers to unpatched systems in observed incidents. The company reported no evidence of destructive activity in the second wave, but that does not establish that all activity was detected or that other consequences were absent.
Hotfix and Gateway Review
Organizations using affected Check Point products should apply the November Jumbo Hotfix at the applicable release level, beginning with internet-facing Mobile Access portals, then cover all Management Servers and Security Gateways. Administrators should review the exposed systems against the indicators and guidance in Check Point advisories sk1000302 and sk1000362 and the company’s incident report.
US federal agencies face CISA’s stated November 16, 2026 deadline for the root-access flaw. The source material does not specify a later public reporting date from Check Point or CISA. Further clarity on attribution, scope and any additional affected systems will depend on updates from the company and investigations by impacted organizations.
Key Questions
Which Check Point hotfix should administrators install?
Install the November Jumbo Hotfix. The listed minimums are Take 14 on R82.20, Take 52 on R82.10, Take 132 on R82, and Take 174 on R81.20. Check Point advises applying it to all Management Servers and Security Gateways, with internet-facing Mobile Access portals first.
What vulnerabilities were used in the attacks?
Check Point says attackers used CVE-2026-109618 and CVE-2026-109619, the PHP2Shell flaws, to run code through the Mobile Access portal. They then exploited CVE-2026-123039 to gain root access.
Did the attacks destroy data?
Check Point reported that, in some cases in the first wave targeting Israeli organizations, attackers reached VMware ESXi hosts and ran the destroy_v6 wiper. It said the second wave showed no evidence of destructive activity.
Has Check Point identified the attackers?
No high-confidence attribution has been made. Check Point said the available evidence does not allow it to assess the operation’s nature with high confidence.
Source: Thorsten Meyer AI
