---
title: Check Point admins: the October PHP2Shell hotfix wasn't enough for the attack chain; get on the November Jumbo Hotfix | ctxsec
url: https://ctxsec.com/items/tip-checkpoint-november-jumbo-hotfix-mobile-access-first
description: "The attacks used PHP2Shell for entry and CVE-2026-123039 for root; the November Jumbo Hotfix bundles both fixes, plus the Node2Shell hotfix."
status: "guide (based on Check Point's Nov 12, 2026 advisory)"
published: 2026-11-12
---

> The attacks used PHP2Shell for entry and CVE-2026-123039 for root; the November Jumbo Hotfix bundles both fixes, plus the Node2Shell hotfix.

[← Tips & Guides](/tips) · [markdown](/items/tip-checkpoint-november-jumbo-hotfix-mobile-access-first.md)

guide (based on Check Point's Nov 12, 2026 advisory)

2026-11-12 7:40 PM ET

### Check Point admins: the October PHP2Shell hotfix wasn't enough for the attack chain; get on the November Jumbo Hotfix

- Inventory every Security Gateway and Management Server and its Jumbo take; internet-facing Mobile Access Portals go first.
- If a gateway ran Mobile Access unpatched between Oct 23 and Nov 4, hunt it with Check Point's IOCs before you trust it again.
- Keep firewall logs off-box so a crashed or tampered logging daemon doesn't leave you blind.

Sources: [Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026)](https://blog.checkpoint.com/security/security-advisory-active-exploitation-of-php2shell-and-local-privilege-escalation/)