Check Point Firewall Attacks 2026: UK Buyer Playbook

What actually happened to Check Point gateways

Attackers chained two issues to turn internet-facing firewalls into launch pads. First, they exploited PHP2Shell — the collective name for two critical, unauthenticated remote-code-execution flaws in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 — via Check Point's Mobile Access portal to get a foothold on the appliance.

From there they escalated to root using CVE-2026-123039, a 7.8-rated local privilege escalation flaw in the Gaia OS Dynamic CLI service. According to Network World's reporting, the daemon runs as root and listens on a local socket that any process can write to without verifying the caller, meaning an attacker with any code execution on the box can escalate to root.

Check Point said exploitation began in late October, affecting a couple of dozen customers. Check Point Research reported a second wave on 2 November affecting organisations in multiple countries and sectors. Analysts found web shells hidden inside the Mobile Access login templates, a persistent TSGA backdoor whose TSProxy component concealed command traffic — described by the incident report as disguising it as normal network activity — and, in the most damaging cases, a pivot over SSH to VMware ESXi hosts where the destroy_v6 wiper was deployed, with politically themed messages left by a group calling itself Dream Security Ltd.

Why this is a topology problem, not just a patch problem

"For customers, one foothold delivered the full menu: Spying, staying, and destroying," said Frank Dickson of Dickson Research. "For Check Point, the cost is trust. A firewall is supposed to be the strongest point in the network, not the softest."

Erik Avakian of Infotech frames this as a false assumption UK buyers need to drop: that security infrastructure is inherently secure because it's designed to provide protection. In reality, a firewall or VPN gateway is as attractive a target as anything it guards, precisely because compromising it grants leverage over everything behind it. Treating these appliances as high-value assets — with the same access controls, patching discipline and monitoring rigour applied to core infrastructure — is now a baseline expectation, not a nice-to-have, which is where vulnerability management services earn their keep.

The management plane is the real prize

Based on Network World's comparison, this incident sits inside a wider 2026 pattern rather than standing alone. In January, Fortinet disclosed attackers abusing FortiCloud single sign-on to log into customers' FortiGate and FortiManager devices and create administrator accounts. CISA added Check Point management server flaws to its exploited-vulnerabilities catalogue in July and September, alongside a Cisco Secure Firewall Management Center flaw rated 10.0 granting unauthenticated root access, and in October Palo Alto Networks warned of attacks on its PAN-OS management interface with root as the explicit prize.

Scott Miserendino of DataBee puts the pattern plainly: edge devices sit at the boundary, hold privileged access, and rarely get the endpoint monitoring applied elsewhere. "Security tools aren't automatically secure, so defend the defenders," he said. For UK buyers reviewing their estate, Check Point's advisory names Management Servers and Security Gateways in its remediation guidance — affected product families reportedly include the Security Management Server, Multi-Domain Security Management systems and Scalable Platforms, and these deserve the same scrutiny as the gateways themselves.

The immediate audit checklist

Check Point's guidance is explicit: deploy the CVE-2026-123039 hotfixes immediately, prioritising any device exposing Mobile Access to the internet. Check Point advises that teams unable to patch right away should stop the dynamic_server process as an interim measure, which may disable some CLI functionality until the fix lands.

Beyond the patch, Dickson's advice for any affected gateway exposed since late October is to disable Mobile Access where it isn't in use, pull management interfaces off the internet entirely, and run the published log checks for compromise. Investigators should look specifically for the indicators of compromise published in Check Point's incident report: session files containing upload_progress_pwn, unexpected CPconfigdaemon processes, unexplained gaps in firewall logs, and any TSGA or TSProxy artefacts. Critically, a potentially exposed gateway should never retain a trusted path into VMware ESXi — that SSH link between firewall and hypervisor is exactly how the wiper stage was reached, and it should be cut regardless of patch status.

• •Inventory every Security Gateway, Mobile Access portal, Security Management Server and Scalable Platform for hotfix coverage
• •Restrict and monitor administrative access to management interfaces, keeping them off the public internet
• •Ship firewall logs off-box in real time to a system the firewall itself cannot reach or alter
• •Audit SSH trust paths between edge appliances and virtualisation hosts, and remove any that aren't strictly required

Architecture, not just patching, is the long-term fix

Patches close the hole but don't evict an attacker who's already inside — Avakian is blunt that affected systems may need rebuilding from trusted images once compromise is confirmed. That reality is pushing UK CISOs toward architectural changes that reduce the blast radius when, not if, an edge device is compromised: segmented networks, separate management planes, least-privilege administration, and immutable off-box logging.

Broader architectural guidance on critical infrastructure — rather than Check Point-specific advice — notes that many sites rely on firewalls and VPNs even where the underlying data flow is genuinely one-way, and that removing the return path via data diodes can stop a compromised edge device being used to send commands back into a facility at all. More broadly, moving toward zero trust and zero-trust microsegmentation means a single compromised gateway no longer implies trusted access to everything behind it, including the hypervisor layer attackers reached in this campaign. Because PHP underpins so much of the web software bolted onto security appliances, Dickson expects PHP2Shell-style flaws to keep recurring, which is why ongoing PHP2Shell vulnerability patching discipline matters well beyond this one advisory. Strengthening perimeter network security and layering managed detection & response over the edge estate gives teams a fighting chance of spotting the next foothold before it becomes a wiper event.