PHP2Shell Exploitation on Check Point Gateway
Source Check Point Research
Mentioned vulnerabilities
Not known to be exploited.
Data as of 12 Nov 2026, 14:04 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 12 Nov 2026.
What to do
AI-suggested
A security fix for the exploited vulnerabilities was available approximately one week before the initial attacks in late October 2026. Organizations should ensure all Check Point Security Gateways, especially Mobile Access portals, are fully patched against CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039. Since this is not a cloud service, patching must be applied by the customer. Remove any unauthorized PHP webshells, backdoors (TSGA, TSProxy), and wiper malware if present. Monitor for indicators of compromise related to PHP2Shell exploitation and privilege escalation attempts. No vendor advisory content was provided to indicate alternative mitigations or no-action status.
Description
Starting October 30, 2026, attackers exploited unpatched Check Point Security Gateways via Mobile Access portals using PHP2Shell for initial access, followed by privilege escalation through CVE-2026-123039. Initial attacks targeted Israeli organizations with destructive activity, while a broader second wave targeted multiple countries without destructive actions. Attackers deployed PHP webshells, the persistent TSGA backdoor with TSProxy, and later pivoted to VMware ESXi hosts to deploy a destructive wiper and leave politically themed notes. The malware tools are linked to the PhiliKit framework, previously associated with China nexus threat actors, though attribution remains uncertain. The campaign exploited multiple vulnerabilities and established persistent, covert access on compromised systems.