Check Point gateways compromised through PHP2Shell chain and root privileges

Check Point has confirmed that since late October, some vulnerable Mobile Access Portals have been targeted through an exploit chain associated with CVE-2026-109618 and CVE-2026-109619. The initial operations, originating from the address 130.94.19[.]204, targeted Israeli organizations about a week after the fixes became available and, in some cases, reportedly resulted in a successful compromise. After gaining initial access, the attacker exploited CVE-2026-123039 in the DynamicCLI IPC mechanism to escalate from the portal service account to root. The obtained privileges were used to install PHP web shells and maintain access to the gateways. A second wave of scans on November 2 reached both previously selected targets and organizations in other countries, with no clear preference for any industry. The presence of active exploitation, persistence, and root-level control makes it urgent to verify installed versions, search for indicators of compromise, and not rely solely on applying patches.

Source: 0dayfans