PHP2Shell Exploitation on Check Point Gateway
By Lotem Finkelstein, VP Research Key findings Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with unpatched Check Point Security Gateways, using Mobile Access portals with PHP2Shell as initial access followed by CVE-2026-123039. The first wave, on October 30, targeted Israeli organizations and included destructive activity against some of them. A broader second wave on November 2 targeted organizations across multiple countries and…
KEV ✓ EPSS 1.00 CVE-2026-109618 CVE-2026-109619 CVE-2026-123039 Check Point VMware IL