As reported by Security Affairs, unpatched Check Point Security Gateways are being actively exploited worldwide through a multi-stage attack chain dubbed "PHP2Shell," with attackers achieving root-level access and deploying destructive payloads. The timeline is particularly alarming — exploitation began approximately one week after a security fix was made available, highlighting the persistent reality that patch latency is the single largest exploitable gap in enterprise perimeter defense.

Security Impact: As reported by Security Affairs, unpatched Check Point Security Gateways are being actively exploited worldwide through a multi-stage attack chain dubbed "PHP2Shell," with attackers achieving root-level access and deploying destructive payloads.

Vulnerability Chain Overview

CVE IDTypeComponentSeverityPatch AvailableIn-the-Wild Exploitation
CVE-2026-109618Initial Access (PHP2Shell)Mobile Access PortalHighYesConfirmed
CVE-2026-109619Initial Access (PHP2Shell)Mobile Access PortalHighYesConfirmed
CVE-2026-123039Local Privilege EscalationDynamicCLI IPC InterfaceCriticalYesConfirmed

Affected Products: Check Point Security Gateways running R81.20 with the Mobile Access blade enabled.

Attack Chain Analysis

The attack demonstrates a well-understood but devastatingly effective pattern: combine an initial access vulnerability with a privilege escalation flaw to achieve total appliance compromise. The attackers first exploited PHP2Shell (CVE-2026-109618/109619) through the Mobile Access portal, then escalated to root via CVE-2026-123039 in the DynamicCLI IPC interface. From root, they deployed webshells disguised as .tpl template files and a persistent backdoor ("TSGA") masquerading as a configuration daemon.

The seven-day gap between patch release and active exploitation is the story here. Threat actors are monitoring vendor advisories as intelligence feeds, not waiting for researchers to publish PoCs.

Who Is at Risk

  • Organizations running Check Point R81.20 gateways with Mobile Access enabled that have not yet applied the available patch
  • Perimeter gateways exposed to the internet through the Mobile Access portal (SSL VPN)
  • Israeli organizations appear to have been the first wave target, but the second wave was opportunistic and global — no sector or geography is safe if unpatched
  • Any deployment where the DynamicCLI interface is accessible post-initial-compromise (which is default behavior)

Indicators of Compromise (IOCs)

  • PHP session files with marker upload_progress_pwn in /opt/CPcvpn-R81.20/tmp/
  • Repeated Apache/PHP process crashes on the portal service
  • Files matching pattern zz*.tpl in the portal login page directory
  • Presence of /tmp/.up.tpl or challenge_render.tpl in portal folders
  • Process /tmp/CPconfigdaemon running (TSGA backdoor)
  • Inbound connections from 130.94.19[.]204

Shield53 Recommendations — Immediate Actions

Shield53 Recommendations — Immediate Actions
Patch immediately. Apply the latest Check Point security fix for R81.20 covering all three CVEs. If the Mobile Access blade is not business-critical, consider disabling it until patched.
Hunt for compromise before patching. If your gateway was exposed and unpatched since late October 2026, assume potential compromise. Check for all listed IOCs, including hidden .tpl files and rogue processes. A clean patch does not remove an attacker's persistence.
  • Restrict Mobile Access portal exposure. If SSL VPN/Mobile Access is required, place it behind a WAF or reverse proxy with GeoIP filtering and rate limiting. The initial exploitation involved scanning — reducing your attack surface reduces scan-to-exploit success.
  • Review and rotate credentials. If compromise is confirmed, rotate all VPN credentials, local admin accounts, and any certificates stored on the gateway. Treat the appliance as fully untrusted — the attacker had root.
  • Monitor for the wiper. The first wave against Israeli organizations included destructive attacks. Ensure you have offline backups of firewall configurations and that change management logs are forwarded to a SIEM that cannot be modified by the firewall itself.
  • Implement network segmentation. A compromised perimeter gateway should not be a launchpad into your internal network. Ensure east-west traffic controls limit lateral movement from the DMZ.

    • This incident reinforces a hard truth: perimeter security appliances are high-value targets. When the device protecting your network becomes the entry point, defense-in-depth is your only remaining layer. Patch cadence for security infrastructure should be measured in hours, not weeks — threat actors are already operating on that timeline.