PHP2Shell Exploited in Destructive Check Point Gateway Attacks
Threat actors have been exploiting PHP2Shell vulnerabilities to hack Check Point Gateway appliances and deploy a wiper against victim organizations, Check Point reports.
The attacks unfolded in two waves. An initial, destructive round started on October 30 and targeted Israeli organizations, and a second one started on November 2, targeting organizations across multiple countries.
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, refers to two critical vulnerabilities leading to remote code execution (RCE) and affecting all PHP versions from PHP 5 onwards. They were patched on October 21, but exploitation started days before patches and mass exploitation shortly after.
Dream has linked attacks targeting PHP2Shell to root Palo Alto Networks firewalls to Chinese hackers, and the hackers targeting Check Point gateways have left a note mentioning the cybersecurity firm.
As part of the Check Point campaign, the attackers exploited PHP2Shell for initial access, then targeted CVE-2026-123039, a local privilege...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
