Check Point hotfixes issued after root-level attack on gateways
Nov 13, 2026 · Summarized by Fundy Tech from 3 sources
Check Point says attackers used PHP2Shell and CVE-2026-123039 to gain root on gateways and deploy a wiper. Emergency hotfixes are now available.
Key points
- Attacks started October 30 and a second wave began November 2.
- Victims included Israeli organisations and others across multiple countries.
- Check Point says a couple of dozen customers were affected by CVE-2026-123039.
Why it matters
If your organisation uses Check Point gateways, this could mean unauthorised access, persistence and possible data loss. The report also says attackers used a wiper on some systems, which raises the stakes for backups and response planning. Small businesses should apply fixes quickly and check for compromise signs.
Who’s affected: Check Point Security Gateways and related products
What to do
- Apply Check Point hotfixes now.
- Stop the dynamic_server process if you cannot patch immediately.
- Review the listed indicators of compromise.
- Check for unusual commands and root-level activity.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.