Check Point said on 12 November 2026 that attackers broke into unpatched Check Point firewalls through their Mobile Access portals, used a new zero-day to become root on the devices, and in some cases moved on to the network behind them. In a limited number of cases they ran a wiper on a VMware ESXi host, the kind of server that often runs a company's file, database and licence servers as virtual machines. Check Point has released a November Jumbo Hotfix, and the firewall flaw is tracked as CVE-2026-123039.
The attacks started on 30 October, one week after Check Point had made fixes available for the entry point, a pair of PHP flaws known as PHP2Shell. Check Point says only a couple of dozen unpatched systems in a single region were compromised, and that it saw the activity until 4 November. Its research team links the tools to malware previously seen in attacks on Ivanti VPN appliances, but says it cannot tell with high confidence who was behind the operation or why.
For SOLIDWORKS teams, the story is not really about one firewall brand. It shows how one unpatched device at the edge of the network can lead to the servers that hold SOLIDWORKS PDM vaults, CAD folders and licences, and how quickly an attacker can switch from stealing to destroying.
TL;DR: patch Check Point gateways now, then check what sits behind them
Attackers exploited PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in Check Point Mobile Access portals and a new local privilege escalation flaw (CVE-2026-123039) to get root on unpatched gateways. They planted backdoors, scanned internal networks and, in some cases, ran a wiper on a VMware ESXi host. Install Check Point's November Jumbo Hotfix, check the indicators of compromise Check Point published, and treat any gateway that was exposed and unpatched after 23 October as possibly compromised. Then make sure your SOLIDWORKS PDM data, file shares and backups would survive the loss of the servers they run on.
What did Check Point disclose on 12 November?
Check Point published two documents on the same day. Its security advisory on the active exploitation lists the flaws and fixes. A detailed technical report from Check Point Research describes what the attackers did on the devices and in the networks behind them.
According to the advisory, the attack chain had three steps:
- Initial access through PHP2Shell. Two flaws in PHP, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution through the firewall's web interfaces. Check Point rates them 9.2 (critical). The attackers used them against the Mobile Access portal, the web portal that gives remote users access to internal applications and files. Check Point lists Security Gateways with the Mobile Access portal from version R80 to R82.20 as affected, plus several versions of its Spark firewalls for smaller offices.
- Root through a new zero-day. CVE-2026-123039, rated 7.8 (high), is a local privilege escalation in the Gaia operating system. A service called the Dynamic CLI daemon runs as root and listens on a local socket that any process can write to, without checking who connects. Anyone who can run code on the device, even with low rights, can send it a command and have it executed as root.
- Persistence and movement into the network. With root, the attackers installed backdoors, and in many cases gained a foothold in the customer's network. In a limited number of cases, Check Point says, they carried out destructive activity that was "ideologically motivated".
The most uncomfortable detail is the timing. Check Point says "Security fixes for Check Point Security Gateway and Management were available one week before the attack, on October 23rd." The entry point already had a fix; the victims had not installed it yet. The privilege escalation step, however, was a true zero-day: Check Point's support article for it was created on 8 November.
How did the attackers get from the firewall to a wiper on ESXi?
The Check Point Research report reconstructs the steps. After the first signs on 30 October, PHP session files with an unusual marker and hundreds of web server crashes, the attackers:
- planted web shells in the portal's template folder, giving them commands, PHP execution and file uploads through the web portal;
- installed a backdoor called TSGA, disguised as a Check Point component, with encrypted remote access, theft of the device configuration and the ability to tamper with firewall logs;
- added a proxy library called TSProxy, so they could route their own traffic through the gateway into the internal network;
- ran a network scanner from the gateway to find internal systems;
- logged in over SSH to a VMware ESXi host using vpxuser, the account that VMware vCenter uses to manage ESXi hosts;
- ran a wiper called destroy_v6 on that host. By default it overwrites files with zeros before deleting them, and it deletes files regardless of extension in the folders it is pointed at.
In each folder it processed, the wiper left a note in Hebrew named DREAM_ANNEXATION.txt that rejects any ransom negotiation. Check Point says the first wave, on 30 October, targeted Israeli organisations and included destructive activity against some of them. A broader second wave on 2 November reached organisations in several countries and sectors, with no destructive activity seen. The report does not say which folders were wiped, whether virtual machine disks were among them, or how the attackers obtained the vpxuser credentials.
Attribution is open. The backdoor and proxy are modified versions of PhiliKit, a toolkit seen in Ivanti attacks and linked by ESET to a China-nexus group, but the destruction and the Hebrew note do not fit that group. Check Point Research says the evidence "does not allow us to assess with high confidence the true nature of this operation".
Why should SOLIDWORKS teams care about a firewall bug?
Most engineering SMEs do not run their SOLIDWORKS infrastructure on separate physical servers. A typical setup puts the SOLIDWORKS PDM archive server, its Microsoft SQL Server database, the SolidNetWork licence server, a file server with shared CAD folders and sometimes the backup server on one or two virtualisation hosts, often VMware ESXi. The firewall in front of them also runs the remote access portal that engineers use from home or from a customer site.
A wiper on the virtualisation host does not need to break into each virtual machine. Pointed at a datastore, it could remove the virtual disks of PDM vault, database, licence server and file server in one step. Check Point has not said this happened in the cases it saw, but the tool deletes any file in the folders it is given.
Earlier this autumn we covered ransomware groups that list CAD drawings as loot and ransomware on unpatched Synology NAS devices. A wiper is worse: there is no negotiation and no decryptor, and recovery depends only on copies the attacker could not reach.
Which SOLIDWORKS systems are at risk behind a compromised gateway?
This table maps the attack chain to a common SOLIDWORKS setup; your own network decides the details.
Keep your own dated proof of what your team designed.
BORIS for SOLIDWORKS registers your CAD files with a blockchain timestamp and a certificate of ownership from inside SOLIDWORKS, so you can still show which designs are yours and when they were created, even after a server is lost.
👉 Get BORIS for SOLIDWORKS
Is this part of a bigger pattern of edge device attacks?
Yes. Firewalls, VPN gateways and remote access portals have been a favourite way into company networks for years. In the past weeks alone we covered the SonicWall VPN flaw that lets attackers skip SAML sign-in and MFA and the Ivanti Connect Secure zero-days. The tools in this attack were first seen in Ivanti attacks. We also wrote about the N-able N-central zero-days that took an IT management platform offline.
CISA has added several Check Point flaws to its exploited vulnerabilities catalogue over the past two years, two of them used by ransomware groups. PHP2Shell is also not specific to Check Point: it is a flaw in PHP, the language behind many web portals, as BORIS Inventor explained in its article on the PHP2Shell vulnerabilities. The same applies to company websites, as our article on the WordPress core flaw exploited during updates showed.
The November Jumbo Hotfix also fixes HTTP2Shell, the Node.js flaw described in our article on Node2Shell.
What should SOLIDWORKS teams do this week?
- Ask who runs your firewall. If it is a Check Point gateway or Spark firewall, find out whether the Mobile Access portal is reachable from the internet and which version and Jumbo Hotfix take it runs. Ask your IT provider in writing.
- Install the November Jumbo Hotfix on all Check Point gateways and management servers, internet-facing Mobile Access gateways first. For CVE-2026-123039, Check Point lists R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174 as fixed. R81.10 and R81 are end of support, so plan an upgrade.
- Look for signs of compromise. Check the indicators Check Point published, such as two scanning IP addresses, unusual files under /tmp and gaps in firewall logs. No match does not rule out a compromise.
- Treat an unpatched, exposed gateway as suspect. If it ran the Mobile Access portal without the October fixes after 23 October, involve your provider or Check Point support, and reset the passwords of accounts that used the portal.
- Lock down your virtualisation hosts. Keep SSH on ESXi switched off unless it is needed, make sure the firewall cannot reach ESXi and vCenter management directly, and review logins by vpxuser and other admin accounts.
- Keep one backup copy out of reach. Back up the PDM archive folders and the SQL Server database together, and keep at least one copy offline or on immutable storage that the virtualisation host cannot delete. Our guide to the SOLIDWORKS PDM vault configuration explains how the archive and database belong together.
- Test a restore. Restore a PDM vault and the licence server to a separate machine at least once, and write down how long it takes. Keep licence files and activation details outside the server they belong to; our article on SOLIDWORKS licence management covers what to keep.
- Keep dated proof of your key designs. Make sure you hold your own timestamped record of the designs that matter most, stored independently of the servers an attacker could wipe.
Should engineers stop using remote access portals?
No, but treat them as a door in the outer wall that attackers test every day. Give remote users only what they need, as our guide to protecting SOLIDWORKS files in remote work explains: an engineer who needs PDM from home does not need a route to ESXi, the backup server or the firewall itself. Keep management networks separate, agree how fast critical fixes for edge devices are installed, and use the CAD security checklist for engineering teams to check the rest. Seven days was enough for the attackers here.
How does this fit the bigger picture for engineering data?
Across our network this week, the same lesson keeps coming up: the systems around your design data are now the main target, and they need the same care as the data itself.
- Industrial networks. CADChain looks at the SANS 2026 survey of ICS and OT security, in which far more respondents with an OT incident reported theft of intellectual property than a year earlier.
- File transfer and remote access. BORIS Inventor explains the exploited IBM Aspera Faspex and OpenSSH flaws that CISA added to its exploited list, and what they mean for teams that send large design files.
- AI training and copyright. Blended BORIS follows the Getty Images v Stability AI appeal hearing in London, where the court considers whether an AI model trained abroad can be an infringing copy in the UK.
Conclusion
The Check Point attacks between 30 October and 4 November 2026 hit only a couple of dozen unpatched gateways, according to Check Point. But the chain they show is common to many engineering companies: an internet-facing portal, a fix that waited a week, a root flaw nobody knew about, and a virtualisation host behind the firewall that held everything. In some cases the result was not theft but deletion.
Patch the gateways, check for signs of compromise, make sure your PDM vault, licence server and backups would survive the loss of their host, and keep your own dated proof of what your team designed.
Prove what your team designed, wherever your files end up.
BORIS for SOLIDWORKS adds blockchain timestamps and certificates of ownership to your CAD files from inside SOLIDWORKS, so you can show which designs are yours and when they were created.
👉 Get BORIS for SOLIDWORKS
FAQ: the Check Point gateway attacks for SOLIDWORKS teams
What is CVE-2026-123039?
It is a local privilege escalation flaw in Check Point's Gaia operating system, rated 7.8. The Dynamic CLI service runs as root and accepts commands from any local process, so an attacker who can run code on the device can become root. Check Point says it was exploited in the wild.
What is PHP2Shell?
PHP2Shell is the name for two flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without logging in. The attackers used them against the Mobile Access portal on Check Point gateways. Check Point says fixes were available from 23 October 2026.
Which Check Point products are affected?
Check Point lists Security Gateways with the Mobile Access portal from R80 to R82.20 and several Spark firewall versions as affected by PHP2Shell. CVE-2026-123039 affects Gaia R81 to R82.20 gateways and management servers. The fix is the November Jumbo Hotfix.
Was any SOLIDWORKS or engineering company hit?
Check Point has not named any victims. It says a couple of dozen unpatched systems in a single region were compromised. No manufacturing victims have been reported.
Could a wiper on ESXi delete my SOLIDWORKS PDM vault?
If your PDM archive server and SQL Server run as virtual machines on that host, their disks are files on its datastore. A wiper running on the host with access to those files could delete them. That is why at least one backup copy should be offline or on immutable storage.
Is SOLIDWORKS itself vulnerable?
No. These are flaws in Check Point products and PHP. The risk comes from what sits behind a compromised firewall: PDM, licence and file servers, and backups.
How does BORIS for SOLIDWORKS help?
BORIS does not patch firewalls or replace backups. It registers your SOLIDWORKS files with blockchain timestamps and certificates of ownership, so you hold your own dated proof of which designs your team created, independent of your servers.