Covered by 3 outlets — first reported by Check Point Research, Nov 12, 13:56 UTC
PHP2Shell Exploitation on Check Point Gateway
MentionsCheck PointVMwareVMware ESXi
Summary
Check Point Research says attackers targeted Israeli organizations in late October 2026 through vulnerable Mobile Access portals on Check Point Security Gateways, about one week after a security fix became available. The activity came from one IP address and, in some cases, appeared to be a successful compromise consistent with PHP2Shell exploitation. SecurityWeek reports the attacks were destructive and that a second flaw, CVE-2026-123039, let the attackers gain root privileges after the initial break-in.
AI summary by the SecurityTabs newsroom, checked against Check Point Research, SecurityWeek. Read the outlets below for the full story.
Continue reading
3 outlets, in the order they reported it.
Check Point ResearchFirst report
PHP2Shell Exploitation on Check Point Gateway
Key findings Introduction We have now confirmed that, in late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile…
SecurityWeek
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
The Hacker News
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a…
Explained
The technology and terms in this story. Learn more
- AttackBackdoorA hidden way back into a system that bypasses normal logins.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-1325Improperly controlled sequential memory allocation
- CWE-1419Incorrect Initialization of Resource
- CWE-416Use After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-732Incorrect Permission Assignment for Critical Resource.