official (Check Point security advisory, Nov 12, 2026); exploited in the wild Oct 30 to Nov 4
Check Point: PHP2Shell plus Gaia root bug CVE-2026-123039 exploited against unpatched Security Gateways, some hit with a wiper
- Do now: install the November Jumbo Hotfix on all Management Servers and Security Gateways, internet-facing Mobile Access first.
- Also fixed (not exploited): CVE-2026-107484 (Gaia WebUI privilege escalation, 7.3) and CVE-2026-120490 (management-to-gateway access via NAT rule, 3.8).
- Hunt: see the Check Point IOC item; patching after compromise doesn't remove persistence.
Sources: Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026)