guide (based on Check Point's Nov 12, 2026 advisory)
Check Point admins: the October PHP2Shell hotfix wasn't enough for the attack chain; get on the November Jumbo Hotfix
- Inventory every Security Gateway and Management Server and its Jumbo take; internet-facing Mobile Access Portals go first.
- If a gateway ran Mobile Access unpatched between Oct 23 and Nov 4, hunt it with Check Point's IOCs before you trust it again.
- Keep firewall logs off-box so a crashed or tampered logging daemon doesn't leave you blind.
Sources: Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026)