[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faGntKrS4przTAi2JNTchrt_0_J6CgO5SQ7WgpazWd2k":3},{"article":4,"iocs":56,"watch_terms":74,"solutions":75,"lesson":169},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"a2ec8b15-a572-448b-beac-b409183601bb","PHP2Shell Exploited in Destructive Check Point Gateway Attacks","php2shell-exploited-in-destructive-check-point-gateway-attacks-7182a3","PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. The post PHP2Shell Exploited in Destructive Check Point Gateway Attacks appeared first on SecurityWeek.","Threat actors are exploiting PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) to compromise Check Point Gateway appliances and deploy destructive wiper malware. The attacks occurred in two waves, initially targeting Israeli organizations and later expanding globally. Attackers used PHP2Shell for initial access, then CVE-2026-123039 for privilege escalation to root, deploying webshells and wiper malware.","Attackers exploit PHP2Shell and CVE-2026-123039 to deploy wipers on Check Point gateways.","https:\u002F\u002Fwww.securityweek.com\u002Fphp2shell-exploited-in-destructive-check-point-gateway-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002FCheck-Point-Software.jpg","2026-11-13T07:39:04+00:00","2026-11-13T08:00:17.881485+00:00",8,[17,20,22,25,28,31],{"name":18,"type":19},"Check Point Gateway","product",{"name":21,"type":19},"VMware ESXi",{"name":23,"type":24},"PHP","technology",{"name":26,"type":27},"UNC5221","threat_actor",{"name":29,"type":30},"Check Point","vendor",{"name":32,"type":30},"Palo Alto Networks","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,63,66,69,71],{"type":58,"value":59,"context":60},"cve","CVE-2026-109618","PHP2Shell vulnerability for remote code execution",{"type":58,"value":62,"context":60},"CVE-2026-109619",{"type":58,"value":64,"context":65},"CVE-2026-123039","Local privilege escalation in DynamicCLI process",{"type":37,"value":67,"context":68},"TSGA","Malware framework variant used for backdoor access",{"type":37,"value":70,"context":68},"TSProxy",{"type":37,"value":72,"context":73},"PhiliKit","Malware framework previously seen in China-linked operations",[29,32,18],{"controls":76,"vendors":163},[77,105,134],{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,97],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":78,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":135,"name":136,"problem":137,"products":138},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[164],{"slug":165,"name":29,"logo_path":166,"roles":167},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[168],"affected",{"slug":170,"title":171,"body":172,"framework_refs":173,"framework_notes":179},"unpatched-check-point-gateways-weaponized-for-destructive-wiper-attacks","Unpatched Check Point Gateways Weaponized for Destructive Wiper Attacks","Threat actors exploited two PHP2Shell vulnerabilities in Check Point Gateway appliances to gain initial access, then chained a privilege escalation flaw to achieve root-level control and deploy wiper malware. The destructive nature of the payload — not just data theft but active destruction — amplifies the consequences of delayed patching on internet-facing security appliances. Security gateways are high-value targets precisely because they sit at the perimeter, and leaving them unpatched effectively hands attackers the keys to the network. This incident underscores that vulnerability management must prioritize internet-exposed infrastructure, especially devices marketed as security products, which organizations may incorrectly assume are inherently hardened.",[174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":182,"CIS Control 12: Network Infrastructure Management (v8)":183,"CIS Control 7: Continuous Vulnerability Management (v8)":184},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling — operators of Check Point gateways in scope of NIS2 would be obligated to have processes ensuring these critical CVEs were patched promptly.","SI-2 mandates identifying, reporting, and correcting information system flaws within organizationally defined timeframes — enforcing this control would have driven rapid patching of the three CVEs before attackers could exploit them.","This category requires organizations to analyze the scope and impact of detected incidents, which is critical here given the destructive wiper payload that could cause irreversible damage if not rapidly scoped and contained.","CIS Control 12 calls for secure configuration and management of network devices, including perimeter appliances, which would have prompted hardening and prompt patching of the gateway appliances targeted here.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, particularly on internet-facing assets — timely scanning and patching of the Check Point gateways would have closed the attack vector before exploitation."]