Severity: Critical | Priority: 1
PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. From late October 2026, an attacker used them against unpatched Check Point Security Gateways through their internet-facing Mobile Access portals. Check Point reports confirmed exploitation at around two dozen customers. The first wave hit Israeli organisations, and a second wave in early November reached organisations in several countries and sectors.
After getting in through the portal, the attacker used a separate Gaia OS privilege-escalation flaw, CVE-2026-123039 in the DynamicCLI interface, to gain root. They planted PHP webshells in the Mobile Access templates directory. They then installed TSGA, a backdoor built specifically for Check Point gateways that masquerades as a gateway daemon, together with a companion component, TSProxy, that hides inside gateway processes. These give the attacker encrypted remote access, steal the gateway configuration, survive in backups and snapshots, and tamper with firewall logs. In some intrusions the attacker used the gateway to scan the internal network, moved on to VMware ESXi hosts and deployed a wiper. Check Point has linked the tooling to a malware family previously used against Ivanti appliances and associated with a China-nexus threat group.
Install the November Jumbo Hotfix on every Check Point Management Server and Security Gateway in your network, starting with gateways that have Mobile Access exposed to the internet. The fixed releases are R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174. Until the hotfix is in place, Check Point’s interim mitigation is to disable the dynamic_server process.
Patching does not remove an implant that is already installed, so check each gateway for signs of compromise:
If you find any of these, treat the gateway and its stored secrets as compromised. TSGA can persist through backups and snapshots, so rebuild from known-good media rather than recent backups. Rotate VPN, administrator and integration credentials, and check VMware ESXi hosts and other internal systems for lateral movement.