Attackers exploit Check Point gateways for root and ESXi wipes
Original title: The firewall becomes the foothold: Attackers turn Check Point gateways against customers
PHP2Shell gave unauthenticated portal access, then a local bug yielded root, persistence and a wiper.
Check Point released emergency hotfixes for CVE-2026-123039, a 7.8 privilege escalation to root in the Gaia OS Dynamic CLI. Attackers have exploited it since late October after entering Mobile Access through PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. Check Point said a couple of dozen customers were affected. Intruders hid web shells, installed TSGA and TSProxy, altered logs, then pivoted over SSH to VMware ESXi and deployed the destroy_v6 wiper.
Unconfirmed: The customer count is Check Point's figure, and Dream Security Ltd is only a name left in messages.
- PHP2Shell bugs are rated 9.2 and allow unauthenticated remote code execution.
- A root service accepts local socket writes without checking the caller.
- TSProxy survives reboots and can hide in backups and snapshots.
- Messages were signed by a group calling itself Dream Security Ltd.
- Stopping dynamic_server is a temporary mitigation but can break some CLI commands.
Impact: root on the gateway, config theft, log tampering and ESXi wiping
| Product | Affected |
|---|---|
| Check Point Firewall | — |
| Check Point Security Gateway | — |
| Check Point Security Management Server | — |
| Check Point Multi-Domain Security Management Server | — |
| Check Point Scalable Platforms | — |
- 1.Deploy the CVE-2026-123039 hotfixes, starting with internet-exposed Mobile Access devices.
- 2.If patching must wait, stop dynamic_server and prevent it from restarting.
- 3.Disable unused Mobile Access, keep management off the internet, and review logs since late October.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1021.004 SSHT1485 Data Destruction
- Vendors
- Check Point
- Threat actors
- Dream Security Ltd
- Malware
- TSGATSProxydestroy_v6
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |
From the original article
5 min read at csoonline.com
A firewall is intended to be a boundary attackers can’t cross. But firewalls face the web, making them just as vulnerable to attack as other systems, as evidenced by the emergency hotfixes released by Check Point Software for several of its products.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.