decrypted · 13 november 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

A firewall's web portal became the way in, and a wiper followed

The firewall that guards your front door has been used as the way in. Check Point Research said on 12 November that attackers have been breaking into unpatched Check Point Security Gateways, the firewalls many organisations rely on, and in some cases going on to destroy files on the virtual servers behind them. This is separate from this morning's post, and the detail only landed in the last day.

What happened

The activity began on 30 October, roughly a week after a security fix became available, Check Point said. The first wave hit Israeli organisations and included destructive activity. A second wave on 2 November reached organisations across several countries and sectors, with no destruction seen. Check Point's own advisory says it saw active exploitation against "a couple of dozen customers".

How the chain worked

Think of the gateway's remote access portal as a reception desk facing the street. The first flaw, known as PHP2Shell, let attackers slip instructions past the desk. The second, CVE-2026-123039, was a master key left in an unlocked drawer: a control channel inside the gateway that any local process could use to reach its most privileged component. Together they took an outsider from the street to full control of the box.

The attackers then hid small web shells among the portal's login page templates and installed a custom backdoor. Using a service account over SSH (the encrypted way administrators log in), they reached a VMware ESXi host, the software that runs virtual machines, and ran a wiper there. Check Point could not say who was behind it. The tooling resembles a kit linked to a suspected China-nexus group, but the destruction and the Hebrew note do not fit that group's usual aims. In Check Point's words: "the evidence does not allow us to assess with high confidence the true nature of this operation."

What a defender sees

Not much, unless they look. Check Point lists bursts of crashes in the portal's web workers, odd template files in the portal directory, a backdoor listening on TCP port 11072, and SSH sessions from the gateway to ESXi hosts using the service account. A gateway logging into your hypervisors is never normal.

The Secure by Design lesson

The fixes are Jumbo Hotfix Take 14 for R82.20, Take 52 for R82.10, Take 132 for R82 and Take 174 for R81.20. Check Point lists no fix for R81.10 or R81, which are end of support, so those owners must upgrade.

Patching is the floor, not the lesson. In my opinion the design failure is trust: a perimeter device running a public web portal also held a route to the heart of the estate. Secure by Design asks that a compromised edge box be a bad day, not a lost datacentre. That means gateways denied any path to hypervisor management, service accounts that cannot log in from places they should not, and backups kept offline where a wiper cannot reach them.

Also this week

Maersk confirms data theft from an inherited system. Maersk confirmed that hackers took data from an IT system it inherited through an earlier acquisition. A group calling itself WhiteArmor listed the company on its leak site on 7 November and demanded $5 million in bitcoin within 30 days. The group claims about 100GB, including driver records and staff accounts, and says it came from a platform tied to LF Logistics, which Maersk bought in 2022. Those figures are the group's claims and are unverified. Maersk says "the incident is isolated to a local system" and that it found no impact on customer systems connected through API and EDI links. It also asked people to treat unexpected communications about the matter with caution and verify them through their usual Maersk contact, which is sensible, because scammers follow headlines. The lesson for UK firms that grow by acquisition: an inherited system carries its old security with it until you deliberately retire or rebuild it.

Microsoft shows an AI agent can be backdoored by editing fewer than 10 neurons. Microsoft's 10 November write-up describes an agent model that passes all evaluations, yet runs an attacker's command when a trigger string appears in its context. The edit needs no retraining, only enough memory to run the model. Microsoft says it has not seen threat actors use the technique, and that audits reduce risk but do not guarantee safe behaviour. Its advice is practical: compare every checkpoint with its declared base model, take models only from the original publisher, verify file hashes, and stop agents pulling models from public hubs at runtime. It also says to run agent-generated code only in isolated sandboxes and to require human approval for high-impact tool calls. For UK organisations buying in agents, this is ordinary supply chain discipline applied to model weights, which deserve the scrutiny we give code.

Sources

If you want help checking how far your edge devices can reach into the rest of your estate, get in touch.