CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Check Point Cloud Firewall

product · product:check-point-cloud-firewall single-source

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package reissued 28…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Check Point Cloud Firewall, newest first. Check the date before acting on an older one.

  • Install the Check Point hotfix for your release on every gateway, cluster member and security-group member that uses Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing, put the R81.20 package of 2026-10-28 on Jumbo Hotfix Accumulator take 166 or later wherever Mobile Access is used, and until the hotfix is in apply Check Point's cp-httpd.conf mitigation, which you remove before installing it.
    2026-10-29CVE-2026-109618 +1

Defender insights

What each entry about Check Point Cloud Firewall tells a defender to do, newest first.

2026-10-29NOTABLEexploitedCheck Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package reissued 28 October

Exposure · detection

Story timeline

  1. 2026-10-29CVE-2026-109618 / CVE-2026-109619, Check Point Force, Spark and Cloud firewalls: the PHP2Shell flaws reach the web interfaces of gateways that run Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing; hotfixes since 2026-10-23, the R81.20 package reissued on 2026-10-28 (CVSS 9.2)
    trending-vulnerabilitiesCheck Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package reissued 28 October

Hunting pivots

CVEs (exploited first)
CVE-2026-109618CVE-2026-109619
Releases covered
Check Point Cloud Firewall
Tags
cisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-29/check-point-php2shell-sk1000302-portal-and-vpn-gateways · ATT&CK page ↗

Entries about Check Point Cloud Firewall (1)

2026-10-29 · view entry permalink →

NOTABLECVE-2026-109618 +1exploitedNATOA2

CVE-2026-109618 / CVE-2026-109619, Check Point Force, Spark and Cloud firewalls: the PHP2Shell flaws reach the web interfaces of gateways that run Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing; hotfixes since 2026-10-23, the R81.20 package reissued on 2026-10-28 (CVSS 9.2)

Check Point's advisory sk1000302, created on 2026-10-21 and last modified on 2026-10-28, says that under certain circumstances the PHP flaws CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2, may allow remote code execution through firewall web interfaces (Check Point, 2026-10-28). Affected are Force, Spark and Cloud firewalls that use one or more of Mobile Access Portal (not Spark), Remote Access VPN with SSL Network Extender (not Spark), Remote Access VPN with SAML realm authentication, the Identity Awareness captive portal, the UserCheck portal and Zero Phishing, on R81.20, R82, R82.10 and R82.20 and on Spark R81.10.x and R82.00.x; R80 to R81.10 and the older Spark lines are end of support and also listed (Check Point, 2026-10-28). Check Point's portal and SaaS services are already patched, Security Management and Log Servers are not affected, and its products are not vulnerable to the third PHP issue, CVE-2026-115560 (Check Point, 2026-10-28).

The hotfix, first published on 2026-10-23, implements the PHP 7.4 fix, is compatible with every Jumbo Hotfix Accumulator take, goes on each gateway, cluster member, security-group member or standalone server and needs a reboot; the R82, R82.10 and R82.20 packages were reissued on 2026-10-26 to support standalone deployments, and the R81.20 package was reissued on 2026-10-28 to fix a Mobile Access problem, must sit on take 166 or higher and is required where the Mobile Access Portal is used (Check Point, 2026-10-28). For the gateway packages the fix is also planned for the Jumbo Hotfix Accumulators of 2026-11-11, and Spark has R82.00.11 (build 998002823) and R81.10.17 (build 996004992) (Check Point, 2026-10-28). Until a hotfix is installed, Check Point's mitigation is a block in cp-httpd.conf that denies requests with a multipart Content-Type, followed by a restart of the portals, which is removed before installing the hotfix; R82.20 gateways are also protected by the "PHP Remote Code Execution" IPS signature even when IPS is not enabled (Check Point, 2026-10-28). CISA lists both PHP flaws as exploited since 2026-10-26, and the sk makes no statement on exploitation of Check Point gateways (CISA KEV, 2026-10-28).

Under certain circumstances, PHP vulnerabilities may allow Remote Code Execution through firewall web interfaces.

Check Point products are not vulnerable to CVE-2026-115560.

This Hotfix implements the PHP 7.4 published fix for CVE-2026-109618 and CVE-2026-109619.

Check Point (sk1000302) 2026-10-28

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; 19 of 20… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass through 6.14.1 and 6.11.16 is affected by PHP2Shell; hotfix patches exist for… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link… · F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data… · PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp…

vulnerability29 Oct 04:48Zsingle-sourceOpen finding →
Sources: Check Point (sk1000302) · CISA Known Exploited Vulnerabilities catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (50%)
  • support.checkpoint.com1 (50%)
All cited sources (2)