[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdv9sm-0cyY4BsjaiHNhJ5K0FWqEIbMrrwaDKqTU3xmQ":3},{"article":4,"iocs":55,"watch_terms":81,"solutions":82,"lesson":174},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"1ca368cf-e5ea-4ebc-8191-7f945e898f0a","Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell","unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell-80909b","Unpatched Check Point gateways were hacked worldwide, leading to root access, backdoors, network intrusion and destructive wiper attacks. Starting on 30 October, an attacker scanned and exploited Check Point Security Gateways that hadn’t been patched, going in through the Mobile Access portal. Check Point Research describes the activity as PHP2Shell for initial access, followed by […]","Attackers exploited unpatched Check Point Security Gateways via the Mobile Access portal, using PHP2Shell for initial access and a privilege escalation vulnerability (CVE-2026-123039) to gain root access. The attackers deployed webshells, a backdoor named TSGA, and a proxy tool called TSProxy. In some cases, a Linux wiper named destroy_v6 was used, leaving a note named DREAM_ANNEXATION.txt.","Unpatched Check Point gateways were wiped after exploitation of PHP2Shell and privilege escalation flaws.","https:\u002F\u002Fsecurityaffairs.com\u002F202982\u002Fhacking\u002Funpatched-check-point-gateways-are-being-wiped-exploiting-php2shell.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-27.png","2026-11-13T11:35:05+00:00","2026-11-13T13:00:31.620771+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Security Gateway","product",{"name":21,"type":22},"Check Point","vendor",{"name":24,"type":25},"Mobile Access portal","technology",{"name":27,"type":25},"PHP",{"name":29,"type":25},"Apache",{"name":31,"type":25},"VMware ESXi","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,64,67,69,72,75,78],{"type":57,"value":58,"context":59},"ip","130.94.19.204","IP address originating the attack",{"type":61,"value":62,"context":63},"cve","CVE-2026-123039","Local privilege escalation vulnerability in DynamicCLI IPC interface",{"type":61,"value":65,"context":66},"CVE-2026-109618","Exploitation activity consistent with PHP2Shell",{"type":61,"value":68,"context":66},"CVE-2026-109619",{"type":49,"value":70,"context":71},"PHP2Shell","Initial access tool",{"type":49,"value":73,"context":74},"TSGA","Backdoor deployed by attackers",{"type":49,"value":76,"context":77},"TSProxy","Proxy tool installed by attackers",{"type":49,"value":79,"context":80},"destroy_v6","Linux wiper deployed by attackers",[21,18],{"controls":83,"vendors":167},[84,113,138],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":114,"name":115,"problem":116,"products":117},"patch-management","Automated patch management","Known holes get closed in days, not months.",[118,122,130],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":114,"product_name":119,"url":120,"description":121},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":139,"name":140,"problem":141,"products":142},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[168],{"slug":169,"name":21,"logo_path":170,"roles":171},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[172,173],"affected","reported_by",{"slug":175,"title":176,"body":177,"framework_refs":178,"framework_notes":184},"unpatched-check-point-gateways-wiped-after-chained-exploit-attack","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","Attackers exploited a known vulnerability in Check Point Security Gateways that had not been patched, using the Mobile Access portal as an entry point to deploy PHP2Shell for initial access. By chaining this with a privilege escalation flaw (CVE-2026-123039), attackers achieved root-level control, enabling them to install webshells, backdoors, and a destructive Linux wiper. This incident underscores the severe consequences of leaving internet-facing security appliances unpatched — ironically, the very devices meant to protect the network became the attack surface. Organizations that delay patching network perimeter devices face not just data theft but potentially irreversible destruction of systems and data.",[179,180,181,182,183],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact","NIS2 Article 21(2)(e)","MITRE ATT&CK T1505.003: Server Software Component: Web Shell",{"NIS2 Article 21(2)(e)":185,"NIST SP 800-53 SI-2: Flaw Remediation":186,"CIS Control 7: Continuous Vulnerability Management (v8)":187,"MITRE ATT&CK T1505.003: Server Software Component: Web Shell":188,"NIST CSF 2.0 ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact":189},"This point requires security in acquisition, development, and maintenance including vulnerability handling, which directly covers the obligation to patch known vulnerabilities in critical network devices like these Check Point gateways.","SI-2 mandates timely identification and patching of software flaws; enforcing this control would have ensured the Check Point vulnerability was remediated before active exploitation occurred.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying this to the unpatched Check Point gateways would have closed the initial access vector before attackers could exploit it.","Attackers deployed webshells on the compromised gateways as a persistence mechanism, which this technique specifically describes and for which detection controls should have been in place.","Properly classifying internet-facing security gateways as critical assets would have elevated their patch priority and triggered faster remediation of the exploited vulnerability."]