Critical Alert: PHP2Shell and Check Point Gateway Vulnerabilities Actively Exploited

Threat actors are actively exploiting critical vulnerabilities tracked as CVE-2026-109618, CVE-2026-109619 (PHP2Shell), and CVE-2026-123039 to compromise Check Point Gateway and Management appliances. These attacks have led to destructive wiper deployments in some cases, with exploitation confirmed across multiple countries. If your business uses affected PHP versions or Check Point products, you must update them immediately to mitigate the risk of remote code execution, privilege escalation, and data destruction.

The Exploitation Campaign: What We Know

A sophisticated exploitation campaign is underway, leveraging critical vulnerabilities in PHP and Check Point products. The initial access vector relies on PHP2Shell, which refers to two critical Remote Code Execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CRITICAL) on CVSS v4.0. While PHP Group released patches on October 21, 2026, exploitation began days before the patches were available, with mass exploitation commencing shortly thereafter.

The attacks against Check Point Gateway appliances unfolded in two distinct waves. The first, destructive wave started on October 30, 2026, targeting Israeli organizations. A second wave, observed from November 2, 2026, targeted organizations across multiple countries, including some Israeli entities from the initial wave, though no destructive activity was reported in this phase.

The attack chain typically involves exploiting PHP2Shell for initial remote access. Once inside, attackers targeted CVE-2026-123039, a local privilege escalation vulnerability with a CVSS v3.1 score of 7.8 (HIGH), in the DynamicCLI process to gain root access. This allowed them to deploy PHP webshells for persistence and establish a stronger foothold, especially by placing webshells in directories used by the Mobile Access portal to construct login pages.

Post-exploitation activities included deploying TSGA and TSProxy-variants of the PhiliKit malware framework, previously linked to China-linked UNC5221-for backdoor access and network function interception. Attackers then performed internal asset discovery, moved laterally to VMware ESXi hosts, and, in the first wave, deployed and executed a wiper, leaving a note mentioning 'Dream Security'. Despite operating during typical Chinese working hours and using China-linked malware, Check Point states that the destructive nature of the attacks does not align with known Chinese cyber operations, suggesting potential false-flag scenarios or initial access brokerage.

Are Your Systems Vulnerable? Check Point and PHP Affected Versions

Understanding if your systems are at risk is paramount. The vulnerabilities affect specific versions of PHP and Check Point Quantum Security Gateway and Management products. You need to identify the versions of PHP running on your web servers, applications, or any internet-facing services, as well as the specific hotfix takes installed on your Check Point appliances. Actively exploited vulnerabilities are a critical risk that demands immediate attention. Ensure you cross-reference your current versions against the 'before' versions listed below to determine your exposure.

The affected versions are:

Immediate Actions: Patching and Mitigation Strategies

The most critical action you can take today is to patch all affected systems immediately. For PHP installations, upgrade to the latest available patched versions beyond those listed as vulnerable. Specifically, update to PHP 8.2.35 or newer, 8.3.36 or newer, 8.4.27 or newer, and 8.5.12 or newer, depending on your branch. This addresses the critical RCE vulnerabilities exploited for initial access.

For Check Point Quantum Security Gateway and Management products affected by CVE-2026-123039, you must apply mitigations in accordance with vendor instructions. The facts do not explicitly state the fixed Jumbo Hotfix Take; therefore, you must consult Check Point's official advisories for specific patching instructions for your affected product versions. For US federal agencies, CISA has set a deadline of November 16, 2026, for CVE-2026-123039, and October 29, 2026, for the PHP vulnerabilities.

Beyond patching, implement robust network segmentation to limit lateral movement if a breach occurs. Restrict administrative access to critical systems and enforce strong authentication mechanisms, including multi-factor authentication (MFA). Continuously monitor your network and system logs for any anomalous activity that might indicate an attempted or successful compromise. If you lack in-house resources, consider engaging managed IT services or 24x7 SOC monitoring to ensure timely patching and detection. If you suspect a breach or need assistance with remediation, consider our incident response services immediately.

Indicators of Compromise and Detection Strategies

Vigilant monitoring is essential to detect if your systems have already been compromised. Look for specific indicators of compromise (IoCs) and behavioral anomalies. A primary sign of compromise on Check Point Mobile Access gateways would be the presence of unauthorized PHP webshells, especially within directories used to construct login pages. These files might have unusual names or content not typically found in your environment.

Beyond webshells, monitor for unexpected processes running with root privileges, which would indicate successful exploitation of the local privilege escalation (CVE-2026-123039). Watch for unusual outbound network connections or command-and-control (C2) traffic from your Check Point devices or other systems, consistent with TSGA or TSProxy malware. Review system logs for signs of internal asset discovery, lateral movement attempts-particularly towards VMware ESXi hosts-and any unexpected file creation or modification on critical servers.

Given the destructive nature of some observed attacks, look for evidence of wiper deployment and execution, which would manifest as widespread data corruption or system unavailability. Regular Vulnerability Assessment and Penetration Testing (VAPT) can help identify weak points before attackers do, while External Attack Surface Management (EASM) provides continuous visibility into your internet-facing assets that might expose vulnerable PHP installations.

Why This Matters: Impact on SMBs

Small and mid-size businesses in India and the US must not underestimate the threat posed by these vulnerabilities. While the initial destructive attacks targeted specific entities, the second wave showed opportunistic initial-access attempts globally, indicating that attackers are broadly scanning for and exploiting any vulnerable systems. Your business could easily become a target, regardless of its size or sector.

The destructive nature of wiper attacks, as seen in the first wave, can be catastrophic for an SMB. Such an attack can lead to complete data loss, extended operational downtime, and severe financial repercussions that could threaten your business's survival. The multi-stage nature of this campaign-from initial RCE to privilege escalation, persistence, and lateral movement-underscores the need for a layered security approach to detect and prevent compromise at every step.

For SMBs with limited security resources, timely patching and continuous monitoring can be challenging. This incident highlights the critical importance of keeping all software up-to-date, especially internet-facing components like web servers and security appliances. Investing in robust backup and disaster recovery solutions is also non-negotiable to mitigate the impact of destructive malware. Consider leveraging cybersecurity services or vCISO services to enhance your security posture, implement effective controls, and ensure a proactive defense against evolving threats.

Sources