---
title: Check Point: PHP2Shell plus Gaia root bug CVE-2026-123039 exploited against unpatched Security Gateways, some hit with a wiper | ctxsec
url: https://ctxsec.com/items/checkpoint-php2shell-gaia-cve-2026-123039-exploited-mobile-access-wiper
description: "Check Point Research says attackers exploited PHP2Shell (CVE-2026-109618/109619, CVSS 9.2) in the Mobile Access Portal for initial access, then chained a local privilege escalation in the Gaia OS Dynamic CLI service (CVE-2026-123039, CVSS 7.8; R82.20, R82.10, R82, R81.20) to get root and persist. Activity ran from Oct 30 to Nov 4 and hit a couple of dozen unpatched systems in a single region; PHP2Shell fixes had shipped Oct 23. In many cases the attackers got a network foothold, and in a limited number the attack was destructive and ideologically motivated. Both fixes are in the November Jumbo Hotfix."
status: "official (Check Point security advisory, Nov 12, 2026); exploited in the wild Oct 30 to Nov 4"
published: 2026-11-12
---

> Check Point Research says attackers exploited PHP2Shell (CVE-2026-109618/109619, CVSS 9.2) in the Mobile Access Portal for initial access, then chained a local privilege escalation in the Gaia OS Dynamic CLI service (CVE-2026-123039, CVSS 7.8; R82.20, R82.10, R82, R81.20) to get root and persist. Activity ran from Oct 30 to Nov 4 and hit a couple of dozen unpatched systems in a single region; PHP2Shell fixes had shipped Oct 23. In many cases the attackers got a network foothold, and in a limited number the attack was destructive and ideologically motivated. Both fixes are in the November Jumbo Hotfix.

[← Cybersecurity News](/news) · [markdown](/items/checkpoint-php2shell-gaia-cve-2026-123039-exploited-mobile-access-wiper.md)

official (Check Point security advisory, Nov 12, 2026); exploited in the wild Oct 30 to Nov 4

2026-11-12 7:40 PM ET

### Check Point: PHP2Shell plus Gaia root bug CVE-2026-123039 exploited against unpatched Security Gateways, some hit with a wiper

- **Do now:** install the November Jumbo Hotfix on all Management Servers and Security Gateways, internet-facing Mobile Access first.
- **Also fixed (not exploited):** CVE-2026-107484 (Gaia WebUI privilege escalation, 7.3) and CVE-2026-120490 (management-to-gateway access via NAT rule, 3.8).
- **Hunt:** see the Check Point IOC item; patching after compromise doesn't remove persistence.

Sources: [Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026)](https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/)