CISA adds exploited Check Point Gaia root flaw to KEV catalog
CVE-2026-123039 escalates a local Gaia user to root through an unauthenticated DynamicCLI socket; the KEV deadline is November 16.
78
Malware
TSProxy
- Mentions · 7d10
- Mentions · 30d10
- All mentions10
- First seenNov 12, 2026
- Last mentioned6h ago
Timeline
10 articles · newest firstAttackers exploit Check Point gateways for root and ESXi wipes
PHP2Shell gave unauthenticated portal access, then a local bug yielded root, persistence and a wiper.
84
Check Point gateways exploited via PHP2Shell to wipe ESXi hosts
Attackers chained two PHP RCEs with gateway zero-day CVE-2026-123039, then ran the destroy_v6 wiper.
84
Unpatched Check Point gateways wiped after PHP2Shell exploitation
Two late-October waves used three CVEs for root, webshells and, in Israel, a Linux wiper.
88
Check Point patches exploited Gaia OS flaw granting root (CVE-2026-123039)
Check Point says a couple of dozen customers were hit since late October, with webshells, backdoors, and an ESXi wiper following.
84
Check Point PHP2Shell flaws exploited for root and ESXi wiper
CVE-2026-123039 on Gaia OS R81 through R82.20 followed PHP2Shell entry; named Jumbo Hotfix Takes are the fixes.
84
Attackers exploit Check Point gateway flaws to deploy TSGA and wipe ESXi
Activity began October 30 against Israeli organizations, then widened November 2, using CVE-2026-123039 after PHP2Shell access.
86
PHP2Shell exploited in destructive Check Point gateway attacks
Waves from October 30 and November 2 used two PHP RCE flaws and a DynamicCLI bug to reach root and deploy a wiper.
84
Check Point firewall flaws chained for root access and ESXi wiper
Check Point says a couple of dozen customers were hit in two waves from October 30, with wipers used against some Israeli targets.
82
Unpatched Check Point gateways hit with PHP2Shell and a wiper
After a late-October fix, attackers used PHP2Shell then CVE-2026-123039, deployed TSGA, and wiped some Israeli ESXi hosts.
86
Related CVEs
by mentions- CVE-2026-1230391%7.8Local root command execution via Gaia OS DynamicCLI socket
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- TSGAmalware · 10
- Check Pointvendor · 10
- VMware ESXiproduct · 7
- PhiliKitmalware · 7
- destroy_v6malware · 7
- Mobile Accessproduct · 6
- Security Gatewayproduct · 5
- Gaia OSproduct · 5
- VMwarevendor · 4
- ESETorganization · 4
- UNC5221threat actor · 4
- Check Point Researchorganization · 3
- Check Point Firewallproduct · 2
- Check Point Security Gatewaysproduct · 2
- CISAorganization · 2
- Check Point Mobile Accessproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.