Check Point gateways hit via PHP2Shell and CVE-2026-123039
Attackers chain PHP2Shell with CVE-2026-123039 to reach root on Check Point gateways. See who is affected and what to do now.
TL;DR: Attackers are chaining PHP2Shell with CVE-2026-123039 to take over unpatched Check Point gateways and reach root. Apply Check Point's hotfixes, and review the gateway for signs of compromise.
What happened
SecurityWeek reports that attackers used the PHP2Shell flaws to get a first foothold on Check Point gateways, then used CVE-2026-123039 to climb to root. The attacks are described as destructive, so this is more than quiet access.
CVE-2026-123039 sits in the Gaia OS DynamicCLI daemon. According to the NVD entry, the daemon has full root rights and accepts commands through a local socket that every user may write to, with no check on the sender. Any logged-in local user can therefore pass it an instruction and get it executed with root rights. Check Point scored it 7.8 (high) under CVSS v3.1. The NVD analysis was still pending when we checked, so the list of affected releases is not final.
Am I affected?
You are in scope if you run Check Point Security Gateways on Gaia OS that have not received the vendor's hotfixes. Open Check Point's advisory (support article sk1000362, linked from the NVD entry) for the exact affected releases and the fixed builds, because the public records do not list a fixed version yet. Then treat any unpatched gateway that was reachable from the internet as possibly compromised: review its administrator accounts, scheduled tasks and recent configuration changes, and check backups before you rely on them.
How to check with Stackurity
Be clear about the limits: these are network security appliances, and Stackurity does not cover network appliance firmware, so it will not find PHP2Shell or CVE-2026-123039 on a Check Point gateway. Check the gateway's version in its own console and compare it with the vendor's advisory. What Stackurity does cover is the rest of your estate: Linux servers, applications, repositories and images are matched against new advisories and the CISA exploited-vulnerabilities catalogue every hour, and the risk documentation explains how exploited issues are ranked first. For a similar appliance story, see our note on the exploited Barracuda flaws. The core is open source, and Stackurity Cloud has a 14-day free trial: start a free trial.
