Check Point: PHP2Shell and CVE-2026-123039 exploited against Mobile Access gateways

What happened

On 12 November 2026 Check Point published a security advisory: its research team had seen in-the-wild exploitation of PHP2Shell against Quantum Security Gateways running the Mobile Access portal. The attacks ran from 30 October to 4 November 2026, roughly a week after Check Point shipped its PHP2Shell fix on 23 October. Only gateways that hadn't installed it were hit.

The attacker used PHP2Shell to get into the web portal, a new Gaia OS flaw, CVE-2026-123039, to get root, and then installed backdoors. Check Point says only a couple of dozen unpatched systems, in a single region, were compromised. In a limited number of cases the attack was destructive and ideologically motivated: the attacker moved on to VMware ESXi hosts and ran a wiper.

Check Point Research describes two waves:

• Wave 1 (from 30 Oct) – targeted attacks on Israeli organisations, some of them destructive.
• Wave 2 (from 2 Nov) – broader scanning and exploitation across multiple countries and sectors, including some wave 1 victims. Check Point saw no destructive activity in this wave.

Technical details

The attack chained two bugs. We describe it for defenders only, with no exploitation steps.

• PHP2Shell (CVE-2026-109618, CVE-2026-109619) – memory-handling bugs in PHP itself that can lead to unauthenticated remote code execution. On Check Point gateways PHP powers web interfaces, including the Mobile Access portal. Check Point rates them CVSS 9.2. We explained both bugs in our report on the Synology NAS attacks.
• CVE-2026-123039 – according to Check Point's NVD record, the Gaia OS DynamicCLI daemon runs as root and listens on the world-writable local socket /tmp/dynamic_socket without authenticating the processes that connect. A local user can push a command through it and have it run as root. CVSS 3.1 7.8 (AV:L/AC:L/PR:L), CWE-732 and CWE-862. The attacker used it to escalate from the portal's service account to root.

What Check Point Research found on compromised gateways:

• Web shells named zz*.tpl in the portal's login-page template directory, plus challenge_render.tpl; the full shell needs the hardcoded key zz2026.
• TSGA (/tmp/CPconfigdaemon, relaunched at boot as slot_CPconfigdaemon) – a Linux backdoor with encrypted remote access, configuration theft, persistence through backups and snapshots, and firewall log tampering. It listens on TCP 11072 and the Unix socket /tmp/.p_sock.
• TSProxy (/lib/libcpfwcommon.so) – a shared library for encrypted proxying that hooks network functions in selected gateway processes.
• gogo – an internal network scanner, followed by a hop over SSH to a VMware ESXi host using the vpxuser service account.
• Wiper (listed in the IOCs as destory_v6) – overwrites files with zeros, deletes them and drops a Hebrew note, DREAM_ANNEXATION.txt, in every directory. It demands no ransom.

Attribution: Check Point Research says TSGA and TSProxy resemble PhiliKit, a toolset ESET links to the China-nexus group UNC5221 (Ivanti VPN attacks). The infrastructure ran on LightNode VPS and scanning clustered between 00:00 and 09:00 UTC. Yet the destruction, the focus on Israel and a Hebrew note using the Dream Security brand don't match UNC5221's known motives. Check Point lists several possibilities – the group ran the whole operation, sold access, took part in a false flag, or used destruction as a smoke screen – and makes no high-confidence call.

Who is affected

Per the table in Check Point's advisory:

• PHP2Shell: Security Gateways with the Mobile Access portal, R80 to R82.20, and Spark firewalls R77.20.x, R80.20.x, R81.10.x and R82.00.x (details in sk1000302).
• CVE-2026-123039: Gaia R82.20 with Jumbo Hotfix Take 10 or below, R82.10 with Take 50 or below, R82 with Take 130 or below and R81.20 with Take 173 or below (Security Gateway and Security Management; NVD record, sk1000362).

The same November Jumbo Hotfix fixes two more bugs with no observed exploitation: CVE-2026-107484 (privilege escalation in the Gaia Portal, CVSS 7.3, R80 to R82.20, sk1000291) and CVE-2026-120490 (management-to-gateway access via a NAT rule, CVSS 3.8, R81.20 and R82, sk1000364).

How to tell if you were compromised

Check Point Research published these indicators (defanged, ready for log searches and blocklists). You can also pull them out with our IOC extractor.

# Network (scanning and exploitation)
130.94.19[.]204
130.94.19[.]168
TCP 11072 listening on the gateway (TSGA)

# PHP2Shell exploitation traces
/opt/CPcvpn-R81.20/tmp/   # PHP session files containing upload_progress_pwn
hundreds of Apache/PHP worker segmentation faults

# Files and processes
<portal templates>/zz*.tpl
challenge_render.tpl
/tmp/.up.tpl
/tmp/CPconfigdaemon
slot_CPconfigdaemon
/tmp/.bd.log
/tmp/.p_sock
/lib/libcpfwcommon.so
DREAM_ANNEXATION.txt

# SHA-256
edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3  .tpl web shell
4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8  slot_CPconfigdaemon
d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63  CPconfigdaemon
3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90  gogo
c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237  destory_v6 (wiper)
0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7  DREAM_ANNEXATION.txt
ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7  philistine
fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da  libdssafe.so

Check Point also advises looking for:

• a process or binary posing as a Check Point component named CPconfigdaemon,
• tools with scanner or wiper in the filename under /tmp or /temp,
• unexplained gaps in firewall traffic logs, especially after a logging daemon crash.

As Check Point puts it, finding nothing doesn't rule out compromise, and any match warrants immediate investigation.

What to do

1. Install the November Jumbo Hotfix on every gateway and management server, starting with gateways that expose Mobile Access to the internet.
2. Hunt for the indicators above even if you've already patched – attacks ran from 30 Oct and an update won't remove a backdoor.
3. Treat any hit as a full compromise: isolate the gateway, contact Check Point Support, rebuild from a clean install and rotate every password, certificate and key stored on it.
4. Check the VMware ESXi hosts the gateway can reach – SSH logins, especially as vpxuser, and unexpected file deletions.
5. Check firewall logs for gaps since 30 October; TSGA can tamper with them.
6. Restrict the Mobile Access portal to the users and networks that need it if it doesn't have to face the whole internet, and watch sk1000302 and sk1000362 for updates.

Timeline