Check Point Research has identified active, in-the-wild exploitation of PHP2Shell, a vulnerability in PHP that also affects Check Point Security Gateways. In the observed incidents, the attacker exploited PHP2Shell to gain initial access, then used a local privilege escalation vulnerability to obtain root privileges and establish persistence.
Security fixes for Check Point Security Gateway and Management were available one week before the attack, on October 23rd. Only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents. Affected customers were notified in real time. Check Point Research, through its Incident Response teams, worked to remediate affected systems.
We recommend that customers install the November Jumbo Hotfix on all Management Servers and Security Gateways as soon as operationally possible.
Overview
As part of BLAST and our Frontier AI Readiness Program, Check Point continues to release monthly security fixes that include fixes for vulnerabilities and security hardening.
Recent security incidents, such as PHP2Shell (CVE-2026-109618, CVE-2026-109619) and HTTP2Shell, also known as Node2Shell (CVE-2026-111497), a Brotli decompression vulnerability affecting Node.js and other software, led us to release hotfixes that are now part of the November Jumbo Hotfix.
Check Point is reporting active exploitation of PHP2Shell together with a local privilege escalation vulnerability (CVE-2026-123039). Indicators of compromise are shared below to help customers investigate.
Vulnerability Summary
Observed Attacks
Check Point Research investigated the exploitation of a chain of PHP2Shell and the Dynamic CLI privilege escalation vulnerability against internet-facing gateways. Exploitation activity dates back to October 30 and was observed as active until November 4.
Initial access was gained through exploitation of PHP2Shell in the Mobile Access Portal. While a hotfix for PHP2Shell has been available since October 23rd, we included it in this November Jumbo Hotfix. The privilege escalation vulnerability was then required to elevate permissions.
This activity provided initial access to the customer network and, in many cases, led to a foothold in the network. In a limited number of cases, the attack also involved destructive activity and was ideologically motivated.
Check Point Research, through our Incident Response teams, contacted affected customers on the day the investigation started and worked to remediate affected systems.
Indicators of Compromise
The full technical analysis, hunting details, and IOCs can be found on the Check Point Research blog .
The indicators below were observed during this investigation. Absence of a match does not rule out compromise, and presence of a match warrants immediate investigation.
Scanning and Reconnaissance Source Addresses
- 130.94.19[.]204
- 130.94.19[.]168
Additional Indicators
- PHP session files containing the string upload_progress_pwn.
- A process or binary masquerading as a legitimate Check Point component using the naming pattern CPconfigdaemon.
- Scanning or wiper tooling dropped under /tmp or /temp, such as files with scanner or wiper in the name.
- A ransom-style note file referencing “Dream Annexation” with no payment demand.
- Unexplained gaps in firewall traffic logs, particularly following a crash of the logging daemon.
Recommended Actions
- Install the November Jumbo Hotfix on all Management Servers and Security Gateways.
- Prioritize upgrades of internet-facing Mobile Access deployments.
Solution
Install the November Jumbo Hotfix on all Management Servers and Security Gateways. [Link to SK article — to be added before publication.]
Need Support?
Contact Check Point Support for help assessing exposure, mitigating risk, or installing the hotfix.
