PHP2Shell and CVE-2026-123039 Used in Destructive Check Point Gateway Attacks

Attackers exploited PHP2Shell for initial compromise and CVE-2026-123039 to gain root privileges in destructive attacks against Check Point gateways. The full scope and attribution remain unclear, but the combination of a known tool and a privilege escalation flaw indicates a sophisticated threat actor targeting network perimeter devices.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works