Check Point Gateways Hit by Wiper Attacks Chaining PHP2Shell and New Zero-Day
Attackers exploited unpatched Check Point Security Gateways to deploy wiper malware and backdoors, starting with an October 30 wave targeting Israeli organizations. The campaign chained the PHP2Shell vulnerabilities with a newly disclosed privilege escalation flaw, CVE-2026-123039, to gain root access. While the first wave included destructive activity, a broader second wave on November 2 targeted global organizations without evidence of data destruction. CISA has added the privilege escalation flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 16. Check Point advises immediate installation of the November Jumbo Hotfix and investigation for signs of compromise, noting that attribution remains uncertain due to conflicting evidence regarding the attacker's identity and motives.