Check Point Gateways Targeted in PHP2Shell Campaign Exploiting Critical Vulnerabilities

Check Point security gateways began seeing active scanning and exploitation on 30 October 2026, when threat actors exploited the PHP2Shell vulnerabilities to gain initial footholds and then escalated privileges using CVE‑2026‑123039. The chain allowed deployment of persistent web shells and a custom backdoor, putting customers of several product versions at risk.

What happened

Check Point Research observed two distinct waves. The first, on 30 October, focused on Israeli organisations and included destructive actions. A second wave on 2 November spread to multiple countries and sectors. Both waves used PHP2Shell to breach the gateway, then exploited CVE‑2026‑123039 – a high‑severity (CVSS 7.8) flaw that lets an authenticated local user run arbitrary commands as root via a world‑writable socket.

Technical details

The attack chain started with PHP2Shell providing initial access. Attackers then leveraged CVE‑2026‑123039 for privilege escalation, installing PHP web shells and the TSGA backdoor (identified as slot_CPconfigdaemon) which communicates through TSProxy for encrypted, persistent remote control. Evidence also linked the campaign to CVE‑2026‑109618 and CVE‑2026‑109619, both critical (CVSS 9.2) flaws added to the CISA Known Exploited Vulnerabilities catalog on 26 October.

In the destructive phase, a custom wiper named destroy_v6 was dropped on VMware ESXi hosts, leaving a note named "DREAM_ANNEXATION.txt". Affected Check Point product versions include R82.20, R82.10, R82, R81.20, R81.10 and R81.

Why it matters

Gateways are the frontline defense for corporate networks; compromise can expose internal traffic, allow data exfiltration, and enable further lateral movement. The campaign’s use of a legitimate administrative socket (CVE‑2026‑123039) underscores the danger of unpatched privileged interfaces. Organizations that rely on the affected Check Point versions – especially those in Israel and other nations where the second wave was observed – face heightened risk of service disruption and data loss.

Who is affected

Any entity running the listed Check Point gateway versions is potentially vulnerable. The initial reports highlighted Israeli organisations, but the second wave broadened the target set to include customers worldwide. While the exact number of compromised organisations is unknown, the presence of a destructive wiper suggests that attackers may aim to cause operational downtime beyond mere espionage.

How to protect yourself

Administrators of Check Point Security Gateways should immediately apply the vendor‑provided mitigations for CVE‑2026‑109618, CVE‑2026‑109619 and CVE‑2026‑123039, as outlined in the CISA BOD 26‑04 guidance. Steps include:

• Verify firmware is updated to a version that patches the listed CVEs.
• Restrict access to the world‑writable socket used by CVE‑2026‑123039 and monitor for unexpected command execution.
• Search for indicators of compromise such as the slot_CPconfigdaemon backdoor, TSProxy traffic, or the destroy_v6 wiper on connected ESXi hosts.
• Implement network segmentation to limit the impact of a compromised gateway.
• Review logs for PHP2Shell activity and block related IPs or signatures at the perimeter.

Prompt remediation reduces the chance of attackers establishing persistent access or deploying destructive payloads.

Sources

• CVE-2026-109618 (NVD)
• CVE-2026-109619 (NVD)
• CVE-2026-123039 (NVD)
• github.com (official)
• research.checkpoint.com (official)
• The Hacker News

This brief was prepared with AI assistance from the sources above and reviewed by our editors.