A firewall is the box meant to stop intruders at the edge of an organization's network. Between 30 October and 4 November 2026 it was the door they came in through. Check Point confirmed on 12 November that attackers had taken over a few dozen of its security gateways that had not been patched, and at some organizations they moved on from there to the servers and deleted every file on them.
The first wave hit organizations in Israel. The attackers moved from the gateway to VMware ESXi hosts, the machines that run an organization's virtual servers, ran a program on them that deletes every file whatever its type, and left a text file named DREAM_ANNEXATION.txt carrying a political message. A second wave, starting 2 November, reached organizations in several countries, and according to the researchers did not include the wiping. Both waves also installed a backdoor, software that keeps the attacker's access open after the problem looks closed.
PHP2Shell, patched in October
The way in started with PHP2Shell, the PHP flaw patched on 21 October. The attackers chained it with a new flaw in the gateways' operating system, Gaia, tracked as CVE-2026-123039. Together they gave full control of the device. The US cybersecurity agency CISA added the flaw to its list of actively exploited vulnerabilities on 13 November and gave federal agencies until 16 November to close it.
Check Point recommends installing the gateways' November Jumbo Hotfix. The update closes the flaw but does not remove an attacker who is already inside. An organization whose gateway was unpatched in early November should also check for new user accounts or connections nobody recognizes.
A fake outage email asks for a password
As Microsoft 365 came back after the weekend outage, Microsoft's threat intelligence team warned about fake emails posing as service health notices. They cite the real incident number, EX1550543, and claim that held messages will be deleted within 24 hours unless the link is clicked. The subject line reads Outage followed by a six-character code.
The link leads to a page asking the reader to sign in to their account again. Microsoft says it has not yet seen a successful password theft, and reminds customers that it does not contact them unprompted with support offers. Anyone who received such an email can check service status in the 365 admin center without clicking anything in the message.
Three hours to administrator access
The FBI issued a warning on 13 November about ARTEX, an AI tool built for authorized penetration testing that criminals now use. According to the warning, the tool carries out most stages of an attack on its own, from choosing the target to taking the data out, and in some cases went from first contact to administrator access in under three hours. The developer took the code down in October, but copies keep circulating, and researchers counted more than 1,600 servers running it and reachable from the internet in early November.
For a business without a security team, the gap between a flaw being published and being exploited is getting shorter. An update to the firewall, the router or the remote management tool the technician uses can no longer wait for the end of the month.