Check Point gateways hacked through PHP2Shell: the vendor confirms attacks, a backdoor and a wiper

Top-Secured cyber watch: independent analysis based on the sources listed below. Top-Secured is not affiliated with the companies mentioned and will never ask you for your bank details or passwords.

Check Point says attackers exploited the PHP2Shell flaws in the Mobile Access portal of unpatched Security Gateways, then a second bug to become root. On some targets they installed a backdoor and moved on to VMware ESXi hosts to destroy files.

What happened

On 12 November 2026, Check Point Research published an analysis of attacks against the vendor’s own firewalls. The attackers used PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two flaws in PHP that Check Point rates 9.2 out of 10 and that it addressed for its gateways in an advisory first published on 21 October. The activity started about a week after the fix was available, so only unpatched gateways were hit. A first wave on 30 October targeted Israeli organisations, with destruction at some of them; a second wave on 2 November hit organisations in several countries and sectors, without destruction observed. Check Point does not give a victim count; its advisory for the second flaw mentions active exploitation against a couple of dozen customers.

How attackers got in

The entry point was the Mobile Access portal exposed on the Internet. Once in, the attackers used CVE-2026-123039, a local flaw in the DynamicCLI service, to become root. They dropped web shells in the portal templates, a backdoor that survives reboots, a network proxy library and a scanner. From some gateways they connected over SSH to VMware ESXi hosts and ran a Linux wiper there. Check Point notes overlaps with tools linked to a China-nexus group, but says it cannot determine the true nature of the operation with confidence.

What to do now

1. Patch: Jumbo Hotfix Accumulator Take 14 or later on R82.20, Take 52 on R82.10, Take 132 on R82, Take 174 on R81.20, or the standalone hotfix from sk1000302 (reboot needed). Spark: R82.00.11 build 998002843 or R81.10.17 build 996005005 and later. Check the installed take with cpinfo -y all.
2. On R81.10 and older (end of support), plan an upgrade: no fix is listed for CVE-2026-123039.
3. If you cannot patch at once, apply the manual mitigation of sk1000302 and stop dynamic_server as described in sk1000362.
4. Look for compromise, even after patching: /tmp/CPconfigdaemon, /lib/libcpfwcommon.so, zz*.tpl files in the portal templates, a listener on TCP 11072 (netstat -tlnp), and the IP addresses published by Check Point.
5. If anything is found, rebuild the gateway, rotate its secrets and VPN certificates, and check the ESXi hosts it can reach.

Our take

A firewall is a server too, and its web portals run the same libraries as any website. One week between patch and attack is now the norm: edge devices need the same patch deadline as the most exposed web server, and their management access to the hypervisors should be cut.

Sources

• Check Point Research — PHP2Shell Exploitation on Check Point Gateway
• Check Point — sk1000302: Check Point Response to CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
• Check Point — sk1000362: CVE-2026-123039, local privilege escalation in DynamicCLI
• CERT-FR — CERTFR-2026-AVI-1501 : Multiples vulnérabilités dans les produits Check Point

How we choose, verify and write our analyses →