Check Point Security Gateways

Mentions · 7d2
Mentions · 30d2
All mentions2
First seenNov 13, 2026
Last mentioned1d ago

Timeline

2 articles · newest first

Unpatched Check Point gateways wiped after PHP2Shell exploitation

Two late-October waves used three CVEs for root, webshells and, in Israel, a Linux wiper.

Security Affairsupdated 09:08 UTC · 4h agofirst Nov 13, 11:35 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-109618 CVE-2026-109619 CVE-2026-123039

Attackers exploit Check Point gateway flaws to deploy TSGA and wipe ESXi

Activity began October 30 against Israeli organizations, then widened November 2, using CVE-2026-123039 after PHP2Shell access.

The Hacker Newsupdated 09:08 UTC · 4h agofirst Nov 13, 08:05 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-123039 CVE-2026-109618 CVE-2026-1096192

Related CVEs

by mentions

CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 23d agophpKEVPoC ×18
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 23d agophpKEVPoC ×25
CVE-2026-1230391%7.8
Local root command execution via Gaia OS DynamicCLI socket
published 1d agoCheck Point Gaia OS DynamicCLIKEV

Appears with

TSGAmalware · 2
PhiliKitmalware · 2
destroy_v6malware · 2
TSProxymalware · 2
Check Pointvendor · 2
ESETorganization · 2
Gaia OSproduct · 1
gogomalware · 1
Check Point Researchorganization · 1
VMware ESXiproduct · 1
UNC5221threat actor · 1
VMwarevendor · 1
Mobile Accessproduct · 1

Entities are extracted by the model from each article. First seen Nov 13, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.