PHP2Shell Exploitation on Check Point Gateway

By Lotem Finkelstein, VP Research Key findings Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with unpatched Check Point Security Gateways, using Mobile Access portals with PHP2Shell as initial access followed by CVE-2026-123039. The first wave, on October 30, targeted Israeli organizations and included destructive activity against some of them.

Read the full article at Check Point Research →