Hackers exploit PHP2Shell to wipe Check Point gateways in targeted attacks

Threat actors have launched destructive attacks against Check Point Gateway appliances by exploiting known PHP2Shell vulnerabilities. The campaign, which began in late October, targeted Israeli organizations initially before expanding internationally, using the flaws to gain remote code execution, escalate privileges to root access, deploy webshells, and ultimately install wiper malware to damage victim systems.

The attacks highlight the critical risk posed by these PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which affect all PHP versions from PHP 5 onward and were being exploited even before patches were released on October 21. Organizations using Check Point gateways, particularly Mobile Access portals, are at immediate risk of complete system compromise and data destruction, requiring urgent patching to prevent these sophisticated, multi-stage intrusions.