Check Point gateway vulnerabilities served as an entry point for an attacker inside Israeli organizations starting in late October 2026. The information comes from The Hacker News, in an article dated November 13, 2026. The attacker installed a backdoor there, and the report states that the operation also aimed to delete files from virtualization servers.
Key points
- A backdoor named TSGA was deployed after attackers exploited security appliances that had been left unpatched.
- According to the report, the attack also deletes files on ESXi virtualization servers.
- The targeted organizations are Israeli, and the scenario remains instructive for any Quebec SMB running the same type of equipment.
What we know about the incident
According to The Hacker News, in an article dated November 13, 2026, an unidentified threat actor is targeting Check Point Security Gateways left unpatched. The activity, detailed by Check Point, began on October 30, 2026 and targeted Israeli organizations. The incident therefore occurred in Israel, not in Canada.
The report describes a two-stage chain. Initial access goes through the so-called PHP2Shell vulnerabilities, followed by a previously unreported local privilege-escalation flaw in Gaia OS, which allows the backdoor to be installed. We won’t go into technical detail here: that work belongs to the teams applying the patches.
The source does not name any victims and does not specify their industry. It also does not put a figure on the impact. As a reminder, a security gateway is the equipment that filters traffic between the internet and an internal network. If that piece gives way, how much of the internal network is exposed, and what level of privilege an attacker obtains, depends in particular on the architecture in place and the vulnerabilities exploited.
Check Point gateway vulnerabilities also affect small organizations
A security appliance exposed to the internet is visible from anywhere. Opportunistic attacks scan these addresses and can return to the ones that were never updated. The campaign described by the source targeted Israeli organizations specifically; nothing indicates an indiscriminate sweep. Still, a twenty-person SMB is just as easy to spot as a large enterprise.
Deleting virtualization files can hit a small organization hard. Many SMBs run their accounting, email, and production management on a single host, where backups sometimes sit as well. A wiped host can halt invoicing, delay deliveries, and push customers elsewhere; the scale and duration depend on the state of the backups and the ability to restore them.
The Canadian Centre for Cyber Security lists software updates and backup protection among its baseline controls for small and medium organizations. Public catalogues, such as CISA’s, track vulnerabilities with confirmed exploitation and help decide which patch takes priority.
Checks to run this week
None of these checks require special tools. They consist of knowing which equipment protects your internet access, how long it has gone without an update, and whether your backups would survive the deletion of the server that hosts them. Leadership can request this information today.
- Ask your IT provider for the make, model, version, and date of the last patch applied to the equipment that filters your internet access (leadership).
- Confirm that a backup copy exists outside the virtualization server and remains unreachable from the regular network (IT provider).
- Test the restoration of a randomly chosen accounting folder to confirm the copy is readable (accounting team, with the provider).
No security measure removes every risk, and no provider can promise a specific outcome. Be wary of any pitch that claims otherwise. An up-to-date inventory and offline backups, however, make this kind of scenario considerably harder to pull off.
FAQ
Is my business affected if it uses a Check Point gateway?
The report does not publish any list of affected organizations and does not mention any Canadian victims. The right question isn’t whether you appear on a list, but whether your equipment is up to date. Ask whoever manages your network for the installed version and any pending patches. If the hardware is no longer supported by its manufacturer, plan to replace it.
Why would an attacker target an SMB here?
Because an opportunistic attack doesn’t necessarily sort by company size: an exposed, unpatched appliance can draw attention regardless of revenue. The campaign described by the source did target Israeli organizations specifically. The Canadian Centre for Cyber Security notes that all Canadian organizations are a potential target. An SMB doesn’t need to be a chosen target to be hit.
How much does downtime from this kind of incident cost?
The cost first shows up as days without invoicing, delayed orders, and customers who go elsewhere. IT expenses are only part of it. We don’t publish rates or ranges here: every client’s context is different, and a number pulled out of context would be misleading. The useful exercise is to estimate what a full day of downtime would cost your own business.
Sources
- The Hacker News · press, November 13, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · reference control checklist
- CISA, Known Exploited Vulnerabilities Catalog · vulnerabilities with confirmed exploitation
Source: The Hacker News · https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html
This article was prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed under our editorial policy.
