Unpatched Check Point gateways were hacked worldwide, leading to root access, backdoors, network intrusion and destructive wiper attacks. Starting on 30 October, an attacker scanned and exploited Check Point Security Gateways that hadn’t been patched, going in through the Mobile Access portal. Check Point Research describes the activity as PHP2Shell for initial access, followed by a root-level privilege escalation tracked as CVE-2026-123039.
Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell
About this summary. This is a short excerpt from the description that Security Affairs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/202982/hacking/unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell.html
Source attribution: headline and facts are from Security Affairs (securityaffairs.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PHP2Shell Exploitation on Check Point Gateway
By Lotem Finkelstein, VP Research Key findings Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with unpatched…
PHP2Shell: Why websites are going offline for emergency security updates
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted…
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that…
php2shell one week later: Why one exploit doesn’t work everywhere
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup…
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…
Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged…