The remote-access portal was the front door

Beginning October 30, 2026, an unknown attacker broke into unpatched Check Point Mobile Access portals at Israeli organizations, using the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). On November 2, a second wave spread to organizations across multiple countries and sectors. That's according to Check Point Research's November 12, 2026 report, which The Hacker News covered on November 13, 2026.

The Mobile Access portal is the web page remote staff use to sign in and reach company systems from outside the office. It has to be reachable from the internet to do that job, which also makes it the first thing an attacker can find. Check Point Research says neither wave showed a clear sector preference, which points to opportunistic attempts on any exposed portal rather than a hunt for one industry. In other words, you did not need to be a target to become a victim. You only needed an unpatched portal facing the internet.

PHP2Shell refers to two critical flaws in PHP, the web software that runs inside many products, including these Check Point portals. We covered the PHP side, and what it means for websites and WordPress hosts, in PHP2Shell and the October 2026 PHP update. This piece is about the firewall.

A man in a light blue shirt and tie types on a laptop at a desk in a server room, with coiled network cables beside him.

"A fix was available" is not "we installed it"

Check Point says security fixes for Security Gateways and Management, including its PHP2Shell hotfix for gateways, were available on October 23, one week before the attacks began. According to Check Point's November 12, 2026 advisory, "only a couple of dozen unpatched systems, in a single region, were compromised" in the incidents it observed, and it notified affected customers in real time. The fix is described in Check Point's support article sk1000302.

The warning signs were public before October 30. On October 26, CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog, which means the agency had evidence of attacks. The KEV catalog gave US federal civilian agencies until October 29 to fix them.

So the organizations that were hit had a fix for a week, and a public CISA exploitation warning about the underlying PHP flaws for four days. The gap was not knowledge. It was the distance between a fix being published and someone actually installing it on the box at the edge of the network. Firewalls and VPN gateways can sit outside the routine that keeps laptops and phones updated. They may belong to a provider, a single IT person, or nobody in particular. We saw the same pattern with browsers in Eight Chrome zero-days this year: is your team actually patched? The difference here is that one missed update on one device can expose the whole network.

One gateway foothold reached a wiped host

Check Point Research says that in the destructive cases, PHP2Shell got the attacker into the portal. A second Check Point flaw, CVE-2026-123039 (CVSS 7.8, per sk1000362), which The Hacker News describes as previously unreported, then gave them root, full control of the gateway. Check Point's support article sk1000362 notes that this flaw only works for someone who already has a foothold on the device, which is exactly what the portal break-in provided. Unlike the two PHP flaws, CVE-2026-123039 is not in CISA's Known Exploited Vulnerabilities catalog.

From there, according to Check Point Research, the attacker:

  • planted web shells, hidden pages that accept commands through the portal;
  • installed a persistent backdoor called TSGA, which can tamper with the firewall's own logs, along with a networking component called TSProxy;
  • scanned the internal network to find other systems;
  • moved over SSH to a VMware ESXi host, the server that runs a company's virtual machines, logging in with the vpxuser service account;
  • ran a wiper called destroy_v6, which overwrites files with zeros and deletes them, and left a politically themed note that explicitly rejects ransom negotiation.

Check Point's advisory describes the note as having no payment demand, so there was nothing to negotiate. The same advisory says destructive activity occurred in "a limited number of cases," and Check Point Research says the November 2 wave showed no evidence of destructive activity. The advisory adds that exploitation was observed until November 4.

The lesson for owners is simple. The firewall is supposed to protect the network, but in these cases the compromised firewall became the starting point for reaching the systems behind it.

High-confidence attribution is still open

Check Point Research says TSGA and TSProxy are modified versions of PhiliKit, a malware framework previously seen in attacks on Ivanti VPN appliances. ESET's May 28, 2026 APT Activity Report assessed PhiliKit as part of the SPAWN toolset of UNC5221, a group Mandiant suspects is China-aligned. The Hacker News refers to that group as Armory Castle.

Check Point Research also cites hosting infrastructure previously associated with Chinese-nexus actors, and scanning concentrated in Chinese working hours. But it says the wiper, the focus on Israel and the politically themed note do not fit that group's known interests. Its conclusion is that the evidence "does not allow us to assess with high confidence the true nature of this operation." The scenarios it considers plausible include the same actor running the whole campaign, an initial access broker handing access to someone else, a false flag, or destruction used as a smoke screen.

For a business owner, the answer is the same in every scenario. An espionage group, an access broker and a saboteur all came through the same unpatched door. Who did it matters to investigators. What you do this week does not depend on it.

Five questions for whoever runs your firewall

You don't need to run a firewall to manage this risk. You need clear answers to five questions, whether your firewall is handled in-house, by a managed service provider or by a reseller.

  1. Who installs firewall and VPN fixes, and how fast? Get a name, not a department, and an agreed timeframe for emergency fixes like this one.
  2. Was the October 23 hotfix installed before October 30, and is the November Jumbo Hotfix installed now? These are two separate fixes. The October 23 hotfix closed PHP2Shell. Check Point's advisory recommends installing the November Jumbo Hotfix, which includes the PHP2Shell fix and also fixes CVE-2026-123039, on all Management Servers and Security Gateways "as soon as operationally possible", and says internet-facing Mobile Access deployments come first. If the first fix went in after October 30, ask whether anyone has checked the gateway against the indicators Check Point published. Check Point notes that no match does not rule out compromise.
  3. Does the portal need to face the internet? If remote staff don't use Mobile Access, or use it only occasionally, ask whether it can be switched off or restricted.
  4. How could the gateway reach VMware? In these attacks, the firewall was able to connect to the virtualization host over SSH. Ask whether it should be able to, and who can log in to those hosts.
  5. Would your backups survive a wiper? A wiper deletes, it doesn't encrypt. Ask whether a copy of your critical data is offline or otherwise out of reach of an attacker who controls your servers, and when a restore was last tested.

If the answers are vague, that is your finding.

We can help you with that.

NTx AI Consulting works with owner-led and partner-led privately held businesses that are currently using AI tools in everyday workflows, or would like to be. The complimentary consultation is a working session, not a product demo. If a deeper engagement makes sense, Phase 1 is an AI Disruption Readiness Audit. You can learn more at https://ntx.ventures/ai-consulting/.

Sources

  1. Check Point Research's November 12, 2026 report. https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
  2. The Hacker News covered on November 13, 2026. https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
  3. Check Point's November 12, 2026 advisory. https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/
  4. sk1000302. https://support.checkpoint.com/results/sk/sk1000302
  5. CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog. https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
  6. CISA's Known Exploited Vulnerabilities catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  7. sk1000362. https://support.checkpoint.com/results/sk/sk1000362
  8. ESET's May 28, 2026 APT Activity Report. https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q4-2025-q1-2026/