Check Point Firewalls Hijacked Through PHP2Shell and a New Root Flaw, Some Attacks Destructive

Check Point confirmed on 12 November 2026 that attackers broke into internet-facing Check Point Security Gateways by chaining two vulnerabilities: PHP2Shell, the PHP flaw that also affects the firewall's web portals, and a newly disclosed privilege escalation flaw in the Gaia operating system, CVE-2026-123039. Check Point says the activity ran from 30 October to 4 November 2026 and hit a couple of dozen unpatched customer systems in a single region. In many cases the attackers kept a foothold inside the customer network, and in a limited number of cases the attack turned destructive and was ideologically motivated. Check Point firewalls are a common choice for the boundary between the business network and the plant, so this deserves attention at industrial sites even though no attack on an operational technology (OT) network has been reported.

Update, 13 November 2026: The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-123039 to its Known Exploited Vulnerabilities (KEV) catalog on 13 November 2026, with a due date of 16 November 2026 for federal agencies and a requirement for forensic triage, meaning agencies must check for signs of compromise rather than only patch. Treat that short deadline as a signal for plant gateways too.

What happened

Check Point Research says the attackers first exploited PHP2Shell (CVE-2026-109618 and CVE-2026-109619, rated 9.2 on the Common Vulnerability Scoring System (CVSS)) in the Mobile Access Portal, the web page remote users sign in to. That flaw lets someone with no login run code on the gateway through its web interface. A hotfix for it had been available since 23 October, one week before the attacks began. The attackers then used CVE-2026-123039 (rated 7.8) to become root, the all-powerful administrator account on the device, and to stay on it. Check Point explains that a background service called DynamicCLI runs as root and accepts commands from a local connection point without checking who is sending them, so anyone who already has a foothold on the device can have commands run as root.

According to BleepingComputer's reporting on Check Point's research, the attackers then dropped web shells (hidden pages that give remote control of the device) and backdoor malware, pivoted from the gateway to a VMware ESXi virtualization host, and in some cases deployed wiper malware that destroys data. Check Point's own indicator list includes wiper tooling left in temporary folders and a ransom-style note that asks for no payment, a sign of sabotage rather than profit.

Who is affected

CVE-2026-123039 affects Gaia releases R82.20, R82.10, R82 and R81.20 on Check Point firewalls, Security Gateways, Scalable Platforms, Security Management Servers and Multi-Domain Security Management Servers. PHP2Shell affects Security Gateways with the Mobile Access Portal from R80 through R82.20, and several Spark small office firewall releases. The same November release also fixes CVE-2026-107484 in the Gaia web portal (7.3) and CVE-2026-120490 (3.8), which Check Point says are not known to be exploited.

Fixed versions

Check Point's fix is the November Jumbo Hotfix: R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174 or later (sk1000362). If a gateway cannot be patched right away, Check Point gives a temporary workaround in sk1000362 that stops the DynamicCLI service, with the trade-off that some Dynamic CLI commands stop working until it is re-enabled.

Where this shows up, plant floor to cloud

At many utilities, pipelines, chemical plants and manufacturers, a Check Point gateway sits at the edge of the business network, and often a second one separates the business network from the plant demilitarized zone (DMZ), the buffer network in front of the control system. The Mobile Access Portal is frequently how engineers and vendors reach a jump server and, from there, historians and human-machine interface (HMI) screens. The ESXi hosts that attackers reached in these incidents are the same kind of virtualization servers that now run many plant historians, engineering workstations and supervisory control and data acquisition (SCADA) servers. A wiper reaching those hosts would mean lost visibility and a long rebuild, even if the field devices keep running.

What to do now

1. Install the November Jumbo Hotfix on every Check Point Security Gateway and Management Server, starting with internet-facing gateways that run the Mobile Access Portal, and include gateways that an integrator or managed service provider runs for your plants.
2. If you cannot patch this week, apply Check Point's DynamicCLI workaround from sk1000362, and turn off the Mobile Access Portal on any gateway that does not need it or limit it to known addresses.
3. Hunt for signs of compromise using Check Point's published indicators, such as unexpected files in temporary folders, a process pretending to be a Check Point component, and unexplained gaps in firewall logs. Treat any match as an incident, and rotate administrator and remote access credentials if you were exposed between 30 October and the date you patched.
4. Make sure the plant does not depend on one firewall: keep management interfaces off the internet, keep virtualization host management on a separate administrator network, and confirm you have offline, tested backups of historian, engineering and SCADA virtual machines.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Check Point security advisory, 12 November 2026: https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/ ; Check Point sk1000362: https://support.checkpoint.com/results/sk/sk1000362 ; BleepingComputer, 13 November 2026: https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/