Check Point has confirmed that attackers broke into its own customers' security gateways by chaining two flaws together, then escalated to full root access and planted persistence. The company published its security advisory on Thursday 12 November, warning customers to install the November Jumbo Hotfix immediately.

The attack combined PHP2Shell, the critical PHP remote code execution flaw tracked as CVE-2026-109618 and CVE-2026-109619, with a local privilege escalation in Check Point's Gaia operating system, tracked as CVE-2026-123039. The Gaia flaw, rated 7.8 out of 10, sits in the Dynamic CLI service and affects Gaia versions R82.20, R82.10, R82 and R81.20.

Check Point says exploitation ran from 30 October to 4 November. Only a couple of dozen unpatched systems, all in a single region, were compromised in the incidents it investigated. Fixes for the gateways had been available since 23 October, a week before the attacks began, and affected customers were told in real time while the company's incident response teams helped clean up.

How the attack chain worked

The attackers started from the internet, targeting the Mobile Access Portal on Check Point Security Gateways. PHP2Shell, rated 9.2 out of 10, gave them unauthenticated remote code execution through the firewall's own web interfaces, which run on PHP. That alone was enough for initial access, but not for full control.

Once inside, the attackers used CVE-2026-123039 to escalate their privileges to root on the gateway, then established persistence so they could return. From the compromised firewall, the attack gave them a foothold into the customer's wider network. Check Point says that in a limited number of cases the activity also turned destructive and appeared to be ideologically motivated, rather than a straightforward attempt at theft or ransom.

The same advisory also discloses two further Gaia flaws: CVE-2026-107484, a privilege escalation in the Gaia Portal rated 7.3, and CVE-2026-120490, a management-to-gateway access issue rated 3.8. Check Point says neither of those two has been seen exploited.

How to tell if you were hit

Check Point has published indicators of compromise from its investigation. They include scanning from the addresses 130.94.19.204 and 130.94.19.168, PHP session files containing the string upload_progress_pwn, and a process or binary masquerading as a legitimate Check Point component under the name CPconfigdaemon.

Other warning signs include scanner or wiper tooling dropped under the /tmp or /temp directories, a ransom-style note referencing Dream Annexation with no payment demand, and unexplained gaps in firewall traffic logs, particularly after a crash of the logging daemon. The company stresses that the absence of a match does not rule out compromise, and that any match warrants immediate investigation.

The fix and what to install

Check Point's advice is direct: install the November Jumbo Hotfix on all Management Servers and Security Gateways as soon as operationally possible, and prioritise upgrades of internet-facing Mobile Access deployments. The hotfix includes the PHP2Shell fix, which had already shipped on 23 October, together with the fix for the Gaia privilege escalation.

The incident is a reminder that the devices guarding a network can themselves become the way in. PHP2Shell affected not just Check Point but a wide range of products built on PHP, and it was added to the US CISA list of known exploited vulnerabilities in late October. Any organisation still running an unpatched gateway with its web portals exposed to the internet should treat this advisory as urgent.

Sources: Check Point and Carthage Electronics.