Attackers rooted Check Point gateways and wiped some ESXi hosts
November 14: Security Affairs reports CISA added CVE-2026-123039 to the Known Exploited Vulnerabilities catalog, with a November 16 federal remediation deadline.
Unpatched Check Point gateways were rooted after October 30; some Israeli victims had ESXi hosts wiped, and CISA set a November 16 fix deadline.
Attackers chained PHP2Shell, CVE-2026-109618 and CVE-2026-109619, on unpatched Check Point Mobile Access portals with Gaia DynamicCLI root flaw CVE-2026-123039. They planted PHP webshells, TSGA and TSProxy, then on some paths SSH'd to VMware ESXi as vpxuser and ran destroy_v6, leaving DREAM_ANNEXATION.txt. Check Point Research dates scanning from 130.94.19.204 to October 30; SecurityWeek says exploitation began days before the October 21 PHP patches. The October 30 wave hit Israeli organizations and a November 2 wave was broader and not destructive; Check Point Research, The Hacker News and BleepingComputer cite a couple of dozen customers, while GBHackers reports several dozen. CISA set a November 16 federal deadline for CVE-2026-123039.
- CVE-2026-123039 is CVSS 7.8 missing authorization in DynamicCLI; PHP2Shell bugs are rated 9.2.
- Fixed takes include R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174.
- Spark Firewalls and Smart-1 Cloud are unaffected; stopping dynamic_server is a temporary mitigation.
- Check Point will not attribute the operation with high confidence despite PhiliKit and UNC5221 overlap.
- CSO Online says notes were signed by a group calling itself Dream Security Ltd.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026PHP released patches for the PHP2Shell flaws. · BleepingComputer
- Oct 26, 2026PHP2Shell was added to CISA’s KEV catalog. · BleepingComputer
- Oct 30, 2026Scanning and the first wave hit Israeli organizations. · Check Point Research
- Nov 2, 2026A broader wave showed no destructive activity. · Check Point Research
- Nov 16, 2026Federal agencies must remediate CVE-2026-123039. · Security Affairs
What each outlet adds
beyond the shared facts- Check Point ResearchScanning IP, webshell paths, and no high-confidence attribution.
- Cyber Security NewsNamed Jumbo Hotfix takes; Spark and Smart-1 Cloud unaffected.
- SecurityWeekSays exploitation began days before the October 21 PHP patches.
- BleepingComputerWorld-writable dynamic_socket and stop-dynamic_server mitigation.
- CSO OnlineNotes signed Dream Security Ltd; attackers altered logs.
Coverage
oldest first · one row per article · UTC- · 1d ago
Check Point ResearchFirst report
Unpatched Check Point gateways hit with PHP2Shell and a wiper
After a late-October fix, attackers used PHP2Shell then CVE-2026-123039, deployed TSGA, and wiped some Israeli ESXi hosts.
- · 1d ago
Canadian Centre for Cyber Security
Check Point says a firewall privilege-escalation flaw is exploited
Canada’s Cyber Centre urges admins to apply updates for CVE-2026-123039 and a separate Gaia Portal flaw.
- · 1d ago
CISA Known Exploited Vulnerabilities
CISA lists Check Point local root flaw as exploited (CVE-2026-123039)
Gaia DynamicCLI accepts unauthenticated local commands as root; the federal due date is November 16, 2026.
- · 1d ago
Cyber Security News
Check Point firewall flaws chained for root access and ESXi wiper
Check Point says a couple of dozen customers were hit in two waves from October 30, with wipers used against some Israeli targets.
- · 1d ago
SecurityWeek
PHP2Shell exploited in destructive Check Point gateway attacks
Waves from October 30 and November 2 used two PHP RCE flaws and a DynamicCLI bug to reach root and deploy a wiper.
- · 1d ago
The Hacker News
Attackers exploit Check Point gateway flaws to deploy TSGA and wipe ESXi
Activity began October 30 against Israeli organizations, then widened November 2, using CVE-2026-123039 after PHP2Shell access.
- · 1d ago
GBHackers
Check Point PHP2Shell flaws exploited for root and ESXi wiper
CVE-2026-123039 on Gaia OS R81 through R82.20 followed PHP2Shell entry; named Jumbo Hotfix Takes are the fixes.
- · 1d ago
BleepingComputer
Check Point patches exploited Gaia OS flaw granting root (CVE-2026-123039)
Check Point says a couple of dozen customers were hit since late October, with webshells, backdoors, and an ESXi wiper following.
- · 1d ago
Security Affairs
Unpatched Check Point gateways wiped after PHP2Shell exploitation
Two late-October waves used three CVEs for root, webshells and, in Israel, a Linux wiper.
- · 20h ago
Check Point gateways exploited via PHP2Shell to wipe ESXi hosts
Attackers chained two PHP RCEs with gateway zero-day CVE-2026-123039, then ran the destroy_v6 wiper.
- · 11h ago
CSO Online
Attackers exploit Check Point gateways for root and ESXi wipes
PHP2Shell gave unauthenticated portal access, then a local bug yielded root, persistence and a wiper.
- · 9h ago
CISA lists exploited Check Point Gaia flaw that yields root
Check Point says it saw exploitation at about two dozen customers; fixes start at named Jumbo Hotfix takes, with R81 and R81.10 unsupported.
- · 5h ago
CISA adds exploited Check Point Gaia root flaw to KEV catalog
CVE-2026-123039 escalates a local Gaia user to root through an unauthenticated DynamicCLI socket; the KEV deadline is November 16.
- · 4h ago
CISA adds exploited Check Point and UnrealIRCd flaws to KEV
Federal agencies must fix both entries by November 16; Check Point intrusions used PHP2Shell, then a root bug, webshells, and a wiper.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-114713 | Label tag injection in UnrealIRCd before 6.2.7.1 | 8.6 | <1% | KEVPoC ×2 | KEV |
| CVE-2026-123039 | Local root command execution via Gaia OS DynamicCLI socket | 7.8 | 1% | KEV | KEV |