Check Point Firewall

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenNov 13, 2026
Last mentioned11h ago

Timeline

2 articles · newest first

Attackers exploit Check Point gateways for root and ESXi wipes

PHP2Shell gave unauthenticated portal access, then a local bug yielded root, persistence and a wiper.

CSO Onlineupdated 09:08 UTC · 4h agofirst 01:39 UTC · 11h agoExploit / PoCExploited14 sourcesCVE-2026-123039 CVE-2026-109618 CVE-2026-109619

Check Point patches exploited Gaia OS flaw granting root (CVE-2026-123039)

Check Point says a couple of dozen customers were hit since late October, with webshells, backdoors, and an ESXi wiper following.

BleepingComputerupdated 09:08 UTC · 4h agofirst Nov 13, 10:44 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-123039

Related CVEs

by mentions

CVE-2026-1230391%7.8
Local root command execution via Gaia OS DynamicCLI socket
published 1d agoCheck Point Gaia OS DynamicCLIKEV
CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 23d agophpKEVPoC ×18
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 23d agophpKEVPoC ×25

Appears with

Security Gatewayproduct · 2
TSProxymalware · 2
Check Pointvendor · 2
Mobile Accessproduct · 2
TSGAmalware · 2
Gaia OSproduct · 2
destroy_v6malware · 1
VMware ESXiproduct · 1
Dream Security Ltdthreat actor · 1
Security Management Serverproduct · 1

Entities are extracted by the model from each article. First seen Nov 13, 2026, last mentioned 11h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.