Summary

Unpatched Check Point gateways were hacked worldwide, leading to root access, backdoors, network intrusion and destructive wiper attacks. Starting on 30 October, an attacker scanned and exploited Check Point Security Gateways that hadn’t been patched, going in through the Mobile Access portal. Check Point Research describes the activity as PHP2Shell for initial access, followed by […]

For more information, read the full story at the original source: Security Affairs ↗

Vulnerabilities in this story

• CVE-2026-109618 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-109619 KEV · fix by 2026-10-29 PHP Group PHP, Siemens AMIS TS, Siemens Energy Engage EPSS 99.9% 9.2Critical
• CVE-2026-123039 KEV · fix by 2026-11-16 checkpoint Quantum Security Gateway, checkpoint Quantum Security Management EPSS 1.2% 7.8High

Also reported by

• Network World: The firewall becomes the foothold: Attackers turn Check Point gateways against customers ↗
• The Hacker News: Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files ↗
• BleepingComputer: Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper ↗
• SecurityWeek: PHP2Shell Exploited in Destructive Check Point Gateway Attacks ↗