Check Point · Published 12 Nov
PHP2Shell Exploitation on Check Point Gateway
By matthewsu@checkpoint.com
Excerpt
Key findings
Beginning on 30 October 2026, an attacker executed scanning and exploitation activity against organizations with unpatched Check Point Security Gateways, using Mobile Access portals with PHP2Shell as initial access followed by CVE-2026-123039.
The first wave, on October 30, targeted Israeli organizations and included destructive activity against some of them. A broader second wave on November 2 targeted organizations across multiple countries and sectors, with no evidence of destructive activity
In the investigated intrusion, PHP2Shell provided initial a…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt2
More from Check Point100
Check Point · Web page · Published 10 Nov
Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
During a year-long investigation, Check Point Research identified three distinct operational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and…
Check Point · Web page · Published 12 Dec
November 2023’s Most Wanted Malware: New AsyncRAT Campaign Discovered while FakeUpdates Re-Entered the Top Ten after Brief Hiatus
Researchers reported on a new AsyncRAT campaign where malicious HTML files were being used to spread the stealthy malware. Meanwhile, downloader FakeUpdates jumped straight into second place after a short break from the top ten list Our latest Global Threat…
Check Point · Web page · Published 10 Apr
The Muddy Waters of APT Attacks
The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. Ever since at least 2017, the attackers behind…
Check Point · Web page · Published 3 Dec
Inside Akira Ransomware's Rust Experiment
Check Point Research analyzed the construction and control flow of Akira ransomware’s Rust version that circulated in early 2024, which has specific features uniquely targeting ESXi server. Our analysis demonstrates how Rust idioms, boilerplate code, and…
On the same topics
hunt.io · Web page · Published 15 Oct
Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45 Countries
Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. GreyNoise…
reliaquest.com · Web page · Published 7 Oct
How AI Agents Turned One Exposed Endpoint into a Server Takeover
Editor’s note: This report was authored by Austin Ritchie and Daxton Wirth. This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the…
reliaquest.com · Web page · Published 12 Nov
Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens
Editor’s note: This report was authored by Joseph Keyes. This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat…
Kaspersky · Web page · Published 13 Nov
Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
Our Global Emergency Response Team (GERT) recently investigated an engagement in which an adversary destroyed an organization’s virtualization estate over a 10-day period. The campaign targeted four ESXi hosts, every virtual machine hosted on them, both…