Check Point says attackers broke into a couple of dozen unpatched Check Point firewalls by chaining two flaws: PHP2Shell in the Mobile Access remote-access portal to get in, then a newly disclosed root bug, CVE-2026-123039, to take over the device. CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog on November 13, 2026. If your shop, studio or engineering office has a Check Point gateway, including the smaller Spark firewalls, and staff use it to reach the network from home or the road, here's what to check this week.
What Check Point and CISA have said
In a security advisory dated November 12, Check Point says its research team "identified active, in-the-wild exploitation of PHP2Shell, a vulnerability in PHP that also affects Check Point Security Gateways." In the incidents it investigated, attackers used PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in the Mobile Access Portal for initial access, then used CVE-2026-123039 to get root and stay on the device. Check Point says fixes "were available one week before the attack, on October 23rd," and that "only a couple of dozen unpatched systems, in a single region, were compromised in the observed incidents." It dates the activity from October 30 to November 4.
The advisory lists PHP2Shell as affecting Security Gateways with the Mobile Access Portal on all versions from R80 to R82.20, plus Spark firewall branches R81.10.x, R82.00.x, R77.20.x and R80.20.x. CVE-2026-123039, a privilege escalation in the Gaia OS Dynamic CLI service, is listed for R82.20, R82.10, R82 and R81.20. Check Point's fix is the November Jumbo Hotfix on every Management Server and Security Gateway, starting with internet-facing Mobile Access deployments. The R82.20 Jumbo Hotfix Take 14 notes, for example, list both the PHP2Shell CVEs and CVE-2026-123039 as resolved.
The Check Point Research write-up fills in the rest. A first wave on October 30 targeted Israeli organizations and included destructive activity against some of them. A broader second wave on November 2 hit organizations across multiple countries and sectors, "with no evidence of destructive activity," and neither wave showed a clear sector preference. In the intrusion it examined, the attackers planted web shells in the portal's login-page templates, installed a backdoor disguised as a Check Point process, scanned the internal network, then moved over SSH to a VMware ESXi host and ran a wiper. CISA's KEV alert followed on November 13, and Security Affairs reported a federal remediation deadline of November 16.
What we are not claiming: We don't know of any U.S. manufacturer, production company or engineering firm that has been hit; Check Point describes a couple of dozen compromised systems in a single region and doesn't name victims. We are not saying the wiper was used in the second wave; Check Point Research says it saw no evidence of destructive activity there. We are not attributing the attacks to any country or group; Check Point Research says the evidence does not allow a high-confidence assessment. And we are not saying every Check Point device is exposed: the attack chain went through the Mobile Access Portal on unpatched gateways.
Why this matters to manufacturers, engineering firms and production shops
For a lot of smaller firms, the firewall is the one box nobody touches once it's working. It also tends to be the remote-access door: the portal your estimators, project managers or crew leads use to reach drawings, ERP and file shares from a job site or a hotel room. In this campaign that door was the way in, and the firewall became the launch point into the rest of the network, including the virtualization host that runs everything else. Firms with a CAD file server, a shop-floor system and an ESXi box behind one gateway should take that path seriously.
The second point is timing. Patches were out about a week before exploitation started. If your firewall updates wait for a quarterly maintenance window, or for someone to remember, a week is not enough.
What to do this week
- Find out whether you run Check Point at all, and which version. Ask your IT provider for the model, Gaia version and Jumbo Hotfix take on every gateway and management server, including small Spark appliances at branch sites or shops.
- Confirm Mobile Access is on or off. If it's enabled and reachable from the internet, that gateway goes first. If nobody uses it, have it turned off.
- Install the November Jumbo Hotfix. Check Point's direction is all Management Servers and Security Gateways. For Spark firewalls, ask your provider to check Check Point's sk1000302 for the fix on your branch.
- Hunt, don't just patch. Check Point published indicators: scanning from 130.94.19[.]204 and 130.94.19[.]168, PHP session files containing "upload_progress_pwn," a process named like "CPconfigdaemon," scanner or wiper files under /tmp, and unexplained gaps in firewall logs. Patching after compromise doesn't remove a backdoor.
- Look behind the firewall. The attackers reached ESXi over SSH. Make sure SSH on ESXi hosts is off unless needed, that management interfaces aren't reachable from the firewall's own network, and that your backups are offline or immutable.
- Put firewall updates on a schedule. Agree with your provider on how fast critical firewall and VPN fixes get applied, and get it in writing.
The takeaway for IT decision-makers
Your firewall and remote-access portal are internet-facing software, and they need patching as fast as anything else you own. Check Point had fixes out a week before this campaign started; the systems that were hit were the ones that hadn't installed them. Know which gateways you run, turn off portals nobody uses, patch the rest promptly, and check for signs of a break-in rather than assuming a patch closes the case.
Sources
- Check Point: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026; checked Nov 14, 2026)
- Check Point Research: PHP2Shell Exploitation on Check Point Gateway (Nov 12, 2026)
- Check Point: R82.20 Jumbo Hotfix Take 14 release notes
- Check Point sk1000362: CVE-2026-123039
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Nov 13, 2026)
- Security Affairs: U.S. CISA adds Check Point and UnrealIRCd flaws to its KEV catalog (Nov 14, 2026)