Unpatched Check Point Gateways Exploited via PHP2Shell, Granting Root Access and Enabling Wiper Attacks
Threat actors leveraged unpatched CVE‑2026‑109618/109619 and CVE‑2026‑123039 on Check Point Security Gateways to obtain root, install backdoors and run a destructive wiper. The breach highlights the need for rigorous patch management and continuous configuration monitoring for audit readiness.
ADTP Breach Watch· November 13, 2026· Security Affairs
SeverityHigh
Type🔗 Vulnerability
ConfidenceHigh
ReportedNov 13, 2026
Other / UnknownOrganizations deploying Check Point Security GatewaysVulnerability Exploit
What happened
Actors scanned for Check Point gateways lacking the October 2026 patches, used PHP2Shell to access the Mobile Access portal, escalated to root via CVE‑2026‑123039, installed persistent web‑shells and a wiper that deleted files on internal systems.
Why it matters for trust and compliance
Timely patching and continuous vulnerability monitoring satisfy the control objective of effective vulnerability management, a cornerstone of trust and audit readiness across frameworks.
Provides concrete evidence for patch‑management controls during audits.
Enables continuous monitoring of appliance configurations to detect unpatched states.
Who is affected
Organizations deploying Check Point Security Gateways
Recommended actions
Apply the October 2026 patches for CVE‑2026‑109618, CVE‑2026‑109619, and CVE‑2026‑123039 immediately.
Implement continuous vulnerability scanning of all network security appliances.
Harden the Mobile Access portal and monitor for anomalous PHP activity.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.