Attackers use PHP2Shell flaws to break into Check Point gateways and wipe data

Cybersecurity company Check Point has reported that attackers exploited the flaws known as PHP2Shell to break into its Security Gateway appliances and, in some cases, deploy data-wiping software, according to BleepingComputer and SecurityWeek, which cite the company's analysis published on November 13.

According to Check Point, there were two waves. The first began on October 30 against Israeli organisations: the attackers entered through the gateways' Mobile Access portal, gained administrator privileges through a previously unknown flaw (CVE-2026-123039), installed backdoors and moved to VMware ESXi servers, where they ran a data wiper. The second, from November 2, affected companies in several countries and sectors and, according to the company, did not include data wiping.

PHP2Shell is the name for two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution without authentication. PHP fixed them in emergency patches on October 21, and the US agency CISA added them on October 26 to its catalogue of exploited vulnerabilities, according to BleepingComputer.

Check Point tentatively links the tools used to others seen earlier in attacks attributed to a China-linked group, but says the evidence does not allow the campaign to be attributed with confidence: according to the company, the actor may have run all of it, acted only as an access broker or taken part in a false-flag operation. The attackers left a note with political messages that rejects negotiating a ransom.

The company recommends installing the November Jumbo Hotfix on management servers and gateways, starting with those whose Mobile Access portal is exposed to the internet, and checking previously exposed devices for signs of intrusion. How many organisations were affected has not been published.