[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faEGl-nTNkQ7q5QKU0twXZFsSENwotZQxZDchWRcvT-I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"ac7909f4-be6a-4407-a117-e1a057492b3d","unpatched-check-point-gateways-wiped-after-chained-exploit-attack","1ca368cf-e5ea-4ebc-8191-7f945e898f0a","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","Attackers exploited a known vulnerability in Check Point Security Gateways that had not been patched, using the Mobile Access portal as an entry point to deploy PHP2Shell for initial access. By chaining this with a privilege escalation flaw (CVE-2026-123039), attackers achieved root-level control, enabling them to install webshells, backdoors, and a destructive Linux wiper. This incident underscores the severe consequences of leaving internet-facing security appliances unpatched — ironically, the very devices meant to protect the network became the attack surface. Organizations that delay patching network perimeter devices face not just data theft but potentially irreversible destruction of systems and data.","**Immediate actions:**\n- Apply the latest vendor-issued patches for all Check Point Security Gateway deployments without delay, prioritizing internet-facing portals such as Mobile Access\n- Audit and restrict external access to administrative and remote-access portals until patches are confirmed applied\n- Scan all perimeter appliances for indicators of compromise including webshells, unknown binaries (e.g., TSGA, TSProxy), and anomalous files such as DREAM_ANNEXATION.txt\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on internet-facing security infrastructure\n- Maintain a continuously updated inventory of all network appliances, firmware versions, and patch status\n- Implement network segmentation to limit lateral movement if a perimeter device is compromised\n\n**Detection measures:**\n- Deploy file integrity monitoring on gateway appliances to detect webshell installation or unexpected binary drops\n- Enable centralized logging and alerting for privilege escalation events and anomalous process execution on security appliances\n- Integrate threat intelligence feeds to receive early warning of active exploitation campaigns targeting specific vendor products",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact","NIS2 Article 21(2)(e)","MITRE ATT&CK T1505.003: Server Software Component: Web Shell",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"MITRE ATT&CK T1505.003: Server Software Component: Web Shell":21,"NIST CSF 2.0 ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact":22},"This point requires security in acquisition, development, and maintenance including vulnerability handling, which directly covers the obligation to patch known vulnerabilities in critical network devices like these Check Point gateways.","SI-2 mandates timely identification and patching of software flaws; enforcing this control would have ensured the Check Point vulnerability was remediated before active exploitation occurred.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying this to the unpatched Check Point gateways would have closed the initial access vector before attackers could exploit it.","Attackers deployed webshells on the compromised gateways as a persistence mechanism, which this technique specifically describes and for which detection controls should have been in place.","Properly classifying internet-facing security gateways as critical assets would have elevated their patch priority and triggered faster remediation of the exploited vulnerability.","published","2026-11-13T13:22:53.768051+00:00","2026-11-13T13:22:53.744+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurityaffairs.com\u002F202982\u002Fhacking\u002Funpatched-check-point-gateways-are-being-wiped-exploiting-php2shell.html","unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell-80909b","Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"56ab7f27-5b45-49b5-a31e-ceaaee82883b","2026-11-13","afternoon","ThreatNoir Afternoon Brief — November 13","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-13\u002Fthreatnoir-afternoon-brief-2026-11-13.mp3",[51,54,57],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":55,"problem":56},"Automated patch management","Known holes get closed in days, not months.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]