CVE-2026-109618 / CVE-2026-109619, Check Point Force, Spark and Cloud firewalls: the PHP2Shell flaws reach the web interfaces of gateways that run Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing; hotfixes since 2026-10-23, the R81.20 package reissued on 2026-10-28 (CVSS 9.2)

Check Point's advisory sk1000302, created on 2026-10-21 and last modified on 2026-10-28, says that under certain circumstances the PHP flaws CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2, may allow remote code execution through firewall web interfaces (Check Point, 2026-10-28). Affected are Force, Spark and Cloud firewalls that use one or more of Mobile Access Portal (not Spark), Remote Access VPN with SSL Network Extender (not Spark), Remote Access VPN with SAML realm authentication, the Identity Awareness captive portal, the UserCheck portal and Zero Phishing, on R81.20, R82, R82.10 and R82.20 and on Spark R81.10.x and R82.00.x; R80 to R81.10 and the older Spark lines are end of support and also listed (Check Point, 2026-10-28). Check Point's portal and SaaS services are already patched, Security Management and Log Servers are not affected, and its products are not vulnerable to the third PHP issue, CVE-2026-115560 (Check Point, 2026-10-28).

The hotfix, first published on 2026-10-23, implements the PHP 7.4 fix, is compatible with every Jumbo Hotfix Accumulator take, goes on each gateway, cluster member, security-group member or standalone server and needs a reboot; the R82, R82.10 and R82.20 packages were reissued on 2026-10-26 to support standalone deployments, and the R81.20 package was reissued on 2026-10-28 to fix a Mobile Access problem, must sit on take 166 or higher and is required where the Mobile Access Portal is used (Check Point, 2026-10-28). For the gateway packages the fix is also planned for the Jumbo Hotfix Accumulators of 2026-11-11, and Spark has R82.00.11 (build 998002823) and R81.10.17 (build 996004992) (Check Point, 2026-10-28). Until a hotfix is installed, Check Point's mitigation is a block in cp-httpd.conf that denies requests with a multipart Content-Type, followed by a restart of the portals, which is removed before installing the hotfix; R82.20 gateways are also protected by the "PHP Remote Code Execution" IPS signature even when IPS is not enabled (Check Point, 2026-10-28). CISA lists both PHP flaws as exploited since 2026-10-26, and the sk makes no statement on exploitation of Check Point gateways (CISA KEV, 2026-10-28).