Check Point issues hotfixes for PHP2Shell flaws in firewalls and Spark

Check Point issues hotfixes for PHP2Shell flaws in firewalls and Spark

10 November 2026: Check Point has released hotfixes for the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, on Security Gateway, firewall and Spark appliances, according to Italy's CSIRT, which notes that technical details of exploitation are public. Both flaws are already on CISA's list of exploited vulnerabilities, so an exposed gateway should be patched without waiting for a change window.

Not yet independently verified. These details come from CSIRT Italia's alert. Check Point's own article, sk1000302, would not render as readable text for us, so hotfix build numbers and the vendor's own date have not been confirmed. We will update this when it can be confirmed, and remove this note.

Exposure depends on which blades are on

A gateway is affected only where one of the following is in use:

• Mobile Access Portal
• Remote Access VPN with SSL Network Extender
• Remote Access VPN with SAML Realm
• Identity Awareness Captive Portal
• UserCheck Portal
• Zero Phishing

Spark appliances do not use the first two. Security Management and Log Server are not vulnerable, and Check Point's portal and its SaaS services have already been updated. The vendor also says its products are not affected by CVE-2026-115560.

Releases covered, and those left behind

Hotfixes apply to Security Gateway and firewall R81.20, R82, R82.10 and R82.20, and to Spark R81.10.x and R82.00.x. End-of-support versions are treated differently. On gateways that means R80 through R81.10, and on Spark R77.20.x and R80.20.x, where hotfixes may never arrive. An organisation on one of those should plan a move to a supported release instead of waiting. R82.20 also carries a built-in IPS protection named PHP Remote Code Execution.

Installing it the right way round

Sites that applied the interim workaround have an extra step. The alert says any manual mitigation edits to $CPDIR/web/Apache/conf/cp-httpd.conf must be removed before the hotfix goes on, and the gateway has to be rebooted afterwards. On a clustered pair, that reboot is the point that needs planning.

This is the fourth CSIRT Italia alert in the series, following AL07/261021, AL01/261025 and AL10/261028. Our earlier report on CISA's listing of the two PHP2Shell numbers covers the federal deadline, which has passed, and Synology's fixes show how far the flaw reaches into embedded PHP.

After the patch

Because exploitation details are public and the flaws have been known since October, a patch alone does not show that a device is clean. Review portal and web server logs on the affected blades from late October onward, and check for new administrator accounts or changed configuration. We list Check Point among our cybersecurity companies.

Sources

• CSIRT Italia: AL05/261109, Check Point updates and mitigations for the PHP2Shell vulnerabilities, 9 November 2026