[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnS1XESZu3YyyB29z5TE7R9fNqsQBbjySBQIX1fDsejw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"759760dc-d9c4-4c63-aa5d-5bab8efd6130","unpatched-check-point-gateways-weaponized-for-destructive-wiper-attacks","a2ec8b15-a572-448b-beac-b409183601bb","Unpatched Check Point Gateways Weaponized for Destructive Wiper Attacks","Threat actors exploited two PHP2Shell vulnerabilities in Check Point Gateway appliances to gain initial access, then chained a privilege escalation flaw to achieve root-level control and deploy wiper malware. The destructive nature of the payload — not just data theft but active destruction — amplifies the consequences of delayed patching on internet-facing security appliances. Security gateways are high-value targets precisely because they sit at the perimeter, and leaving them unpatched effectively hands attackers the keys to the network. This incident underscores that vulnerability management must prioritize internet-exposed infrastructure, especially devices marketed as security products, which organizations may incorrectly assume are inherently hardened.","**Immediate actions:**\n- Apply vendor-released patches for CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039 to all Check Point Gateway appliances immediately.\n- Audit all internet-facing gateway appliances for signs of webshell deployment or unexpected file modifications.\n- Temporarily restrict external access to management interfaces until patches are confirmed applied.\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., 24–72 hours) for critical vulnerabilities on perimeter and security appliances.\n- Maintain a continuously updated inventory of all network appliances, including firmware and software versions, to enable rapid patch scoping.\n- Implement network segmentation so that a compromised gateway cannot directly reach internal critical systems.\n\n**Detection measures:**\n- Deploy file integrity monitoring on gateway appliances to detect webshell drops or unexpected binary changes in real time.\n- Ingest gateway logs into a SIEM and create alerts for privilege escalation events and anomalous outbound connections.\n- Run authenticated vulnerability scans against all perimeter devices on at least a weekly cadence.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":20,"CIS Control 12: Network Infrastructure Management (v8)":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling — operators of Check Point gateways in scope of NIS2 would be obligated to have processes ensuring these critical CVEs were patched promptly.","SI-2 mandates identifying, reporting, and correcting information system flaws within organizationally defined timeframes — enforcing this control would have driven rapid patching of the three CVEs before attackers could exploit them.","This category requires organizations to analyze the scope and impact of detected incidents, which is critical here given the destructive wiper payload that could cause irreversible damage if not rapidly scoped and contained.","CIS Control 12 calls for secure configuration and management of network devices, including perimeter appliances, which would have prompted hardening and prompt patching of the gateway appliances targeted here.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, particularly on internet-facing assets — timely scanning and patching of the Check Point gateways would have closed the attack vector before exploitation.","published","2026-11-13T08:20:43.020595+00:00","2026-11-13T08:20:43.007+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-exploited-in-destructive-check-point-gateway-attacks\u002F","php2shell-exploited-in-destructive-check-point-gateway-attacks-7182a3","PHP2Shell Exploited in Destructive Check Point Gateway Attacks",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,52],{"slug":40,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]