Check Point
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- IT leaders should verify if Check Point Gateways are exposed to PHP2Shell and CVE-2026-123039 exploitation risks.
Questions to ask IT
- Do we run Check Point, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 13 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-123039- 7.8 · HighExploitable only with local access and a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Not listed
- Not linked from the CVE record
- PHP2Shell was used for initial compromise, with CVE-2026-123039 allowing privilege escalation to root.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- PHP2Shell was used to gain initial access, with CVE-2026-123039 enabling privilege escalation to root in attacks on
- A report indicates destructive attacks on Check Point Gateways involved PHP2Shell and CVE-2026-123039.
- SecurityWeek reported on attacks involving PHP2Shell and CVE-2026-123039 against
Products and services involved
- Check Point97% match confidence · CVE-2026-123039
Pulse
Last change 2h ago · Next recheck 14 Nov 2026, 08:03 UK time
- Story13 Nov 2026, 08:03 UK time · 2h ago
Linked reporting from SecurityWeek (independent original reporting).
Read source (SecurityWeek)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- SecurityWeekNews
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
- ProbableSummary fact75% confidence
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. The post PHP2Shell Exploited in Destructive Check Point Gateway Attacks appeared first on SecurityWeek. PHP2Shell Exploited in Destructive Check Point Gateway Attacks This website stores cookies on your computer.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-123039