Between 30 October and 4 November 2026, attackers broke into a couple of dozen Check Point Security Gateways and used them as a way into the networks behind them. Check Point published the details on 12 November. The fixes had been available since 23 October, a week before the first attack, and every compromised system was unpatched.
This is not a story about one vendor. Several major firewall brands have had serious flaws exploited this year. It is a story about how the device meant to protect the network became the way into it, and what that means for any business that relies on a firewall with remote access switched on.
What happened
Check Point describes a chain of two steps.
- Getting in. The attackers exploited PHP2Shell, a flaw in the firewall's web interface that allows remote code execution without authentication, on gateways that had the Mobile Access portal exposed to the internet.
- Taking control. They then used a second flaw in Gaia OS, CVE-2026-123039, to go from a limited account to full root access on the device.
From there, according to Check Point Research, the attackers installed web shells and a persistent backdoor, then moved from the gateway to a VMware ESXi host over SSH. In a limited number of cases they ran a wiper. A second wave from 2 November showed no evidence of destructive activity. Check Point says its incident response teams contacted affected customers on the day the investigation started.
Who was behind it is still unclear. Check Point's advisory describes the destructive cases as ideologically motivated, while its researchers say the evidence does not establish a clear motive. Some of the tooling has previously been linked to a China-nexus group, and the researchers do not rule out a false-flag operation.
Why the firewall became the entry point
Firewalls sit at the edge of the network, and many now do much more than filter traffic. They host VPN and remote-access portals, web management pages and integrations. Each of those features is software reachable from the internet, and each can contain flaws.
Three things made this attack possible:
- A portal open to the internet. Mobile Access is useful, but it is also an internet-facing web application running on the firewall itself.
- A patch gap of a week or more. The fixes were out on 23 October. The attacks began on 30 October.
- A path from the firewall to the rest of the network. Once on the gateway, the attackers could reach a hypervisor. That turned a firewall problem into a server problem.
What to do now if you run Check Point
- Install the November Jumbo Hotfix on all Security Gateways and Management Servers. Start with any gateway that has Mobile Access or another portal reachable from the internet.
- Check for signs of compromise before and after patching. Check Point's indicators include a process or file named
CPconfigdaemon, scanning or wiper tools dropped under/tmp, and unexplained gaps in firewall traffic logs, particularly after a crash of the logging service. If anything looks wrong, contact Check Point Support before you clean up, so evidence is not lost. - Switch off portals you don't use. If Mobile Access was enabled for a project and never used, disable it.
- Review who can reach the hypervisors. A firewall should not have open SSH access to your VMware hosts.
What every firewall owner should take from this
Whatever brand you run, the same lessons apply.
- Patch edge devices in days, not months. Agree a standing change window for firewall and VPN updates, and apply critical fixes within a week of release.
- Keep the internet-facing surface small. List every portal and management page your firewall exposes. Disable what you don't use and restrict the rest to known addresses.
- Separate management from production. Firewall management, hypervisor management and backups should sit on their own network, not reachable from the gateway itself.
- Keep offline backups. A wiper destroys what it can reach. Keep at least one backup copy that the network cannot touch, and test restoring from it.
- Watch the logs for gaps. A sudden silence in firewall logs can mean an attacker has stopped or tampered with logging. Alert on it.
The bigger picture
This is the latest in a run of attacks on network edge devices this autumn, alongside exploited flaws in SonicWall SSL VPN and Palo Alto firewall management pages. The time between a fix being released and attacks starting keeps shrinking, which makes a slow patching routine the real risk.
If you would like help checking your firewall versions, reviewing which portals are exposed, or planning a regular update routine for your network security devices, get in touch with our team.
