Check Point Gateway

Mentions · 7d1
Mentions · 30d1
All mentions1
First seenNov 13, 2026
Last mentioned1d ago

Timeline

1 articles · newest first

PHP2Shell exploited in destructive Check Point gateway attacks

Waves from October 30 and November 2 used two PHP RCE flaws and a DynamicCLI bug to reach root and deploy a wiper.

SecurityWeekupdated 09:08 UTC · 4h agofirst Nov 13, 07:39 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-109618 CVE-2026-109619 CVE-2026-1230392 · 1 read

Related CVEs

by mentions

CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 23d agophpKEVPoC ×18
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 23d agophpKEVPoC ×25
CVE-2026-1230391%7.8
Local root command execution via Gaia OS DynamicCLI socket
published 1d agoCheck Point Gaia OS DynamicCLIKEV

Appears with

DynamicCLIproduct · 1
PhiliKitmalware · 1
TSProxymalware · 1
Check Pointvendor · 1
Check Point Mobile Accessproduct · 1
Dream Securityorganization · 1
PHPproduct · 1
TSGAmalware · 1
VMware ESXiproduct · 1

Entities are extracted by the model from each article. First seen Nov 13, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.