Organisations running Check Point Security Gateways with the Mobile Access portal enabled and unpatched should check whether their appliances were compromised after 30 October 2026, when an attacker began systematically scanning and exploiting unpatched units worldwide.
According to an analysis published by Security Affairs, summarising findings from Check Point Research, the campaign — tracked as PHP2Shell — has delivered root-level access, planted backdoors, moved into victim networks, and, in the final stage, deployed destructive wiper malware.
From portal to wiper
The initial access vector is a single chokepoint: the Mobile Access portal on unpatched Check Point Security Gateways. From there the operators escalate to root, establish persistence, spread laterally, and finish with data-wiping payloads. That last stage reframes the risk. This is no longer only a confidentiality incident; availability and recoverability are in play, which changes how defenders should weigh patch urgency and backup strategy for perimeter appliances.
Perimeter appliances are systematically under-patched in many environments because of uptime and compatibility concerns, and the campaign exploits exactly that gap. No local victims have been identified.
What defenders should do
- Audit exposure. Inventory every Check Point gateway and confirm whether the Mobile Access portal is enabled. If it is unused, disable it — that alone removes the initial access vector.
- Patch and verify. Apply the relevant Security Gateway updates and confirm the version actually running, not just the version intended. Every day an unpatched appliance stays online is another day it is being scanned for.
- Hunt for persistence. Because the attackers reach root, any suspect appliance should be treated as potentially compromised — look for root-level accounts, unexpected cron entries, and web shells before returning it to service.
- Recoverability. Test offline backups of configurations and critical data; a wiper campaign makes untested backups a false comfort.
- Indicators. Hashes, domains, and other IOCs are published in the Check Point Research write-up rather than reproduced here; pull them into your blocklists and log searches.
- Reporting. As a local recommendation from this publication, report incidents affecting local infrastructure to HKCERT through its cyber security incident reporting channels, alongside Check Point's own support process.
Bigger picture
The technical novelty here is limited — initial-access-to-wiper chains are a familiar pattern — but the value of this story is its actionability. Defenders have a defined exposure check, a named chokepoint, a patch path, and a clear persistence hunt. For teams that treat internet-facing appliances as set-and-forget infrastructure, the campaign is a reminder that perimeter hardware needs the same lifecycle discipline as servers: tracked versions, tested patches, and backups that have actually been restored.
Source: Security Affairs, reporting Check Point Research findings.
運行 Check Point Security Gateways 並已啟用 Mobile Access portal 而尚未修補漏洞的機構，應檢查設備在 2026 年 10 月 30 日之後是否曾遭入侵——當日攻擊者開始在全球有系統地掃描及攻擊未修補的設備。
根據 Security Affairs 發表的分析（總結 Check Point Research 的調查結果），這場被追蹤為 PHP2Shell 的攻擊活動已取得 root 權限、植入 backdoor、深入受害者網絡，並在最後階段部署具破壞性的 wiper 惡意軟件。
由入口到 wiper
初始入侵向量只有一個瓶頸：未修補 Check Point Security Gateways 上的 Mobile Access portal。攻擊者由此提升至 root 權限、建立持久化機制、橫向移動，最後投放抹除數據的 payload。最後階段改變了風險的性質——這不再只是機密性事故，可用性與可恢復性同樣受到威脅，防禦者評估邊界設備的修補緊迫性及備份策略時，因此需要重新衡量。
在許多環境中，邊界設備因運行時間及相容性顧慮而普遍欠缺修補，是次攻擊活動針對的正是這個缺口。目前尚未有本地受害者被確認。
防禦者應採取的行動
- 審核暴露面。 盤點每一部 Check Point 閘道，確認 Mobile Access portal 是否處於啟用狀態。如未使用，請將其停用——單是此舉已能移除初始入侵向量。
- 修補及驗證。 套用相關 Security Gateway 更新，並確認實際運行的版本，而非僅確認預定安裝的版本。未修補設備每在線一日，就多一日被人掃描。
- 搜尋持久化機制。 由於攻擊者可取得 root 權限，任何可疑設備都應視為可能已被入侵——在恢復服務前，先查找 root 層級帳戶、異常 cron 項目及 web shell。
- 可恢復性。 測試配置及關鍵數據的離線備份；在 wiper 攻擊之下，未經測試的備份只會帶來虛假的安全感。
- 入侵指標。 Hashes、網域名稱及其他 IOC 已刊載於 Check Point Research 的報告，本文不作轉載——請將其納入 blocklist 及日誌搜尋。
- 通報。 作為本刊的本地建議，將影響本地基礎設施的事故透過 HKCERT 的網絡保安事故通報渠道呈報，同時亦應跟進 Check Point 自身的支援流程。
大局觀
本次事件在技術上的新意有限——由初始入侵到 wiper 的攻擊鏈已是常見模式——但新聞價值在於其可操作性。防禦者如今有明確的暴露面檢查方法、具名的瓶頸位置、清晰的修補路徑，以及具體的持久化搜尋指引。對於將對外開放設備視為「設定後不再理會」的基礎設施的團隊而言，是次攻擊活動提醒大家：邊界硬件需要與伺服器同等的生命週期管理紀律——追蹤版本、經測試的修補，以及真正經過還原測試的備份。
來源：Security Affairs，報道 Check Point Research 研究結果。