Check Point firewalls hacked through PHP2Shell and a root bug, patch now

On 12 November 2026, Check Point said attackers had broken into a couple of dozen of its customers' firewalls by chaining two flaws. They got in through PHP2Shell (CVE-2026-109618 and CVE-2026-109619), PHP bugs that let an unauthenticated web request run code through the firewall's web portals, then used a new Gaia OS flaw, CVE-2026-123039, to become root and stay on the device. Check Point says the attacks ran from 30 October to 4 November, hit unpatched gateways in a single region, and in a limited number of cases included destructive, ideologically motivated activity. Fixes for PHP2Shell had been available since 23 October. All are included in Check Point's November Jumbo Hotfix.

The bugs

CVE-2026-109618 and CVE-2026-109619, PHP2Shell on the firewall web interfaces. Check Point rates both 9.2. An unauthenticated attacker who can reach an affected web interface can run code on the firewall. It affects Check Point Force Firewalls, Spark Firewalls and Cloud Firewalls that use the Mobile Access Portal, Remote Access VPN with SSL Network Extender, Remote Access VPN with SAML authentication, the Identity Awareness Captive Portal, the UserCheck Portal or Zero Phishing. Affected versions are R81.20, R82, R82.10 and R82.20, plus end-of-support R80 to R81.10, and Spark Firewalls R81.10.x and R82.00.x (and end-of-support R77.20.x and R80.20.x). Check Point says Security Management and Log Servers and Maestro Orchestrator are not affected. Check Point reports exploitation through the Mobile Access Portal.

CVE-2026-123039, root through the Gaia Dynamic CLI service. Check Point rates it 7.8. A local Gaia process that runs as root accepts commands from any local user without checking who sent them, so anyone who already has code running on the device can become root. It affects Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Log Servers, and Maestro Orchestrator on R82.20, R82.10, R82 and R81.20, plus end-of-support R81.10 and R81. Spark Firewalls and Smart-1 Cloud are not affected. Check Point says it saw this exploited against a couple of dozen customers.

The same advisory also lists two flaws with no reported exploitation: CVE-2026-107484 (7.3), a privilege escalation in the Gaia Portal for authenticated users, and CVE-2026-120490 (3.8), a privilege boundary bypass between Management and Gateway on R81.20 and R82.

The remedy

A fix is available, and installing the November Jumbo Hotfix on every Management Server and Security Gateway is the complete fix. Check Point lists these minimum versions for CVE-2026-123039 and PHP2Shell:

• R82.20: Jumbo Hotfix Accumulator Take 14 or later
• R82.10: Jumbo Hotfix Accumulator Take 52 or later
• R82: Jumbo Hotfix Accumulator Take 132 or later
• R81.20: Jumbo Hotfix Accumulator Take 174 or later
• Spark Firewalls R82.00.11: build B998002843 or later (PHP2Shell)
• Spark Firewalls R81.10.17: build B996005005 or later (PHP2Shell)

If you do not want to move to a new Jumbo Take yet, Check Point also offers a separate PHP2Shell hotfix for R82.20, R82.10, R82, R81.20 and R81.10, which needs a reboot. For R81.20 gateways that use the Mobile Access Portal, it must sit on Jumbo Take 166 or later. That hotfix covers only PHP2Shell, not CVE-2026-123039. Check Point lists no Jumbo fix for CVE-2026-123039 on end-of-support R81.10 and R81, so move those systems to a supported release. Patch internet-facing Mobile Access gateways first.

To confirm the Gaia fix is in place, Check Point says to check the permissions of /tmp/dynamic_socket with ls -l: a fixed system shows srw-rw---- owned by root and the config group, not srwxrwxrwx.

Because this was exploited, also check for a break-in. Check Point's research blog and sk1000362 list indicators, including log checks for unexpected commands in /var/log/dynamicCli.log, unexpected processes named like Check Point components, scanning or wiper tools under /tmp, and unexplained gaps in firewall traffic logs. Check Point says a missing match does not rule out compromise.

If you cannot update today

No setting makes an unpatched gateway safe, so schedule the Jumbo Hotfix now. Until then, Check Point's advisories give these temporary measures:

• PHP2Shell (sk1000302): add Check Point's configuration block to the portal web server config so it refuses multipart requests, then restart the portals. The exact steps differ for gateways, Maestro or ElasticXL, and Spark Firewalls. On R82.20, Check Point says its built-in IPS signature "PHP Remote Code Execution" protects the firewall even when IPS and HTTPS Inspection are off. Remove the manual change when you install the hotfix.
• CVE-2026-123039 (sk1000362): stop the dynamic_server process and stop it restarting, as shown in the advisory. This breaks the Dynamic CLI commands, so turn it back on after you patch.

Sources

• Check Point: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation
• Check Point sk1000362: CVE-2026-123039
• Check Point sk1000302: PHP2Shell response