Attackers broke into unpatched Check Point gateways through Mobile Access. Install the November hotfix and look for webshells

We flagged PHP2Shell, the PHP code execution bug, when attacks on web servers began on October 27. On Thursday Check Point said attackers had used it to break into its own Security Gateways through the Mobile Access portal, then used a second bug to become root.

About two dozen unpatched gateways in one region were compromised, according to Check Point. Some of the attackers then moved on to wipe VMware servers inside the network.

Attackers used PHP2Shell to get into Check Point gateways through the Mobile Access portal, then a second bug to become root. Patch, then check for webshells.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Attackers broke into Check Point gateways through PHP2Shell

Check Point Research says exploitation started on October 30, a week after Check Point shipped a hotfix for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and was seen until November 4. A first wave hit Israeli organizations and included destructive attacks. A second wave on November 2 hit organizations in several countries.

• Way in: PHP2Shell in the Mobile Access portal, unauthenticated, CVSS 9.2. Every gateway version from R80 to R82.20 is affected, plus several Spark firewall branches.
• Root: CVE-2026-123039 (CVSS 7.8). The Gaia dynamic CLI service listens on a world-writable local socket and runs any command it receives as root.
• After that: PHP webshells hidden among the portal’s login page templates, a backdoor named CPconfigdaemon, a network scanner, and, on some networks, an SSH hop to VMware ESXi to run a wiper that leaves DREAM_ANNEXATION.txt notes.

Check Point says affected customers were notified when the investigation started.

Gateways with Mobile Access turned on and no October hotfix

Mobile Access is the remote access portal, so it faces the internet by design. A gateway that missed the October 23 hotfix was open for a week before attacks started.

Patching now closes the door but doesn’t remove a webshell or backdoor already planted. The attackers used the gateway as a step into the rest of the network, so a compromised gateway means the servers behind it need checking too.

Install the November Jumbo Hotfix and look for webshells

• Install the November Jumbo Hotfix on every Security Gateway and Management Server, starting with gateways that run Mobile Access. Check Point lists the fix for CVE-2026-123039 in R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174.
• Confirm the fix landed: ls -l /tmp/dynamic_socket should show mode 0660 owned by root and config, not 0777.
• If a gateway can’t be patched today, Check Point’s sk1000362 explains how to stop the dynamic_server process, at the cost of the dynamic CLI commands.
• Block the two scanning addresses Check Point published, 130.94.19.204 and 130.94.19.168, and search firewall logs for them since October 30.

Details

• CVE-2026-109618, CVE-2026-109619 (sk1000302): PHP2Shell, unauthenticated remote code execution through firewall web interfaces, CVSS 9.2, exploited.
• CVE-2026-123039 (sk1000362): Gaia dynamic CLI local privilege escalation to root, CVSS 7.8, exploited. Affects Quantum Force firewalls, Management and Log Servers, Multi-Domain servers and Maestro Orchestrator on R81 through R82.20. Spark firewalls and Smart-1 Cloud are not affected.
• Also fixed, not exploited: CVE-2026-107484 (Gaia Portal privilege escalation, 7.3) and CVE-2026-120490 (management-to-gateway NAT rule boundary bypass, 3.8).
• Timeline: PHP2Shell hotfix October 23; attacks October 30 to November 4; advisory and research report November 12.

Hunt / verify

• Look under /opt/CPcvpn-*/tmp/ for PHP session files containing upload_progress_pwn.
• Search the portal template folders for files named zz*.tpl or an unexpected challenge_render.tpl, and check for /tmp/.up.tpl.
• Look for processes or files named CPconfigdaemon or slot_CPconfigdaemon, a file at /lib/libcpfwcommon.so, and a listener on TCP 11072.
• Run grep "Rejected connection from unauthorized uid" /var/log/dynamicCli.log after patching; Check Point says unexpected entries point to an escalation attempt.
• Check for gaps in firewall traffic logs after a logging daemon crash, and for SSH logins to ESXi hosts as vpxuser from a gateway.

Source: Check Point advisory; Check Point Research report

Sources

• Check Point Blog: Security Advisory, Active Exploitation of PHP2Shell and Local Privilege Escalation
• Check Point Research: PHP2Shell Exploitation on Check Point Gateway
• Check Point sk1000362: CVE-2026-123039, local privilege escalation in the DynamicCLI process
• Check Point sk1000302: Check Point response to CVE-2026-109618, CVE-2026-109619

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].