Science & Tech · Cybersecurity · 1 hr ago
Check Point fixes flaw used to gain root access in gateway attacks
Attackers exploited a Check Point gateway flaw to gain root access to affected devices.
Check Point says the attacks began in late October, first targeting organizations in Israel and later reaching organizations in multiple countries.
The attackers used PHP2Shell vulnerabilities to enter some systems, then exploited the local privilege flaw CVE-2026-123039 to gain deeper control.
They installed backdoors and moved into victims' networks, reaching VMware ESXi hosts in some cases.
A wiper destroyed data in the first wave, while Check Point observed no destructive activity in the later wave.
The attackers' identity and purpose remain uncertain, and Check Point says several explanations are possible.
Check Point has released emergency fixes and advises customers unable to install them immediately to stop the affected process as a temporary measure.
Check Point released emergency hotfixes for a high-severity flaw exploited to gain root access on vulnerable devices.
The flaw, tracked as CVE-2026-123039, affects the DynamicCLI interface in Gaia OS.
Check Point said it observed active exploitation against a couple of dozen customers.
Attackers used the flaw after gaining initial access through PHP2Shell vulnerabilities, then installed backdoors and moved to VMware ESXi hosts.
A first attack wave targeted Israeli organizations and included destructive wiper activity, while no destructive activity was observed in the second wave.
Check Point said the available evidence did not establish the operation’s true nature with high confidence.
- Who
- Threat actors targeted Check Point gateway appliances; their identity is not established with high confidence.
- What
- Attackers exploited PHP2Shell for initial access and CVE-2026-123039 to gain root access, establish persistence and, in the first wave, deploy wiper malware.
- When
- The first destructive wave started October 30; a second wave started November 2. Check Point said exploitation of the privilege-escalation flaw had been underway since late October.
- Where
- Check Point Mobile Access gateways and Security Gateways at organizations in Israel and multiple other countries.
- Why
- Not stated
This story does not have two clearly opposing sides.
PHP2Shell vulnerabilities were patched.
The first destructive attack wave began, targeting Israeli organizations.
A second wave began, targeting organizations across multiple countries.
Check Point’s emergency hotfixes for CVE-2026-123039 were reported.
- Privilege-escalation flaw
- CVE-2026-123039
- Affected process
- Gaia OS DynamicCLI
- Affected products
- Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server
- Reported exploitation
- A couple of dozen customers
- First-wave target
- Israeli organizations
- Second-wave target
- Organizations across multiple countries
3 sources
What people are saying
Check Point observed an active exploit of this vulnerability against a couple of dozen customers
Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation. Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation. It is also possible that the destructive activity served as a smoke screen