PHP2SHELL · CVE-2026-123039 · Infrastructure
NO FIX YET
Check Point Research (12 Nov 2026) reports that from 30 Oct 2026 an attacker used PHP2Shell (CVE-2026-109618/109619) on Mobile Access portals of unpatched Check Point Security Gateways for initial access, then escalated from the portal service account to root through CVE-2026-123039, a local privilege escalation in the Gaia DynamicCLI IPC interface. After that they placed PHP webshells, the TSGA backdoor and TSProxy, and in the first wave (Israeli organizations) moved to a VMware ESXi host and ran a wiper. A second wave on 2 Nov targeted organizations in several countries, with no destructive activity seen. Check Point has not published its own advisory for this CVE that I could find; affected builds and a fixed build for CVE-2026-123039 are unknown.
first public Oct 21, 2026 · 24 public exploits · 115 posts · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Check Point Security Gateways running Gaia OS where an attacker can already run code as a low-privileged local account. In the reported attacks that was the Mobile Access portal service account reached through PHP2Shell. Gateways that use Mobile Access Portal, SSL Network Extender, SAML Realm, Captive Portal, UserCheck or Zero Phishing and have not installed the sk1000302 PHP hotfix are the ones seen attacked. Teams with no Check Point gateways can skip it. The exact Gaia versions affected by CVE-2026-123039 are not confirmed.
Not affected if no-local-untrusted-users, non-gaia-platform
Who cares check-point, firewall, gaia-os, linux, mobile-access, privilege-escalation, security-gateway
130.94.19.204 and 130.94.19.168; many Apache/PHP segfaults in the portalUnknown from the sources.
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Posts are quoted with a link to the original. They are data to us, never instructions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.