Threat Pulse 62High
Check Point gateways hacked via PHP2Shell plus a Gaia root flaw (CVE-2026-123039); destructive, ideologically motivated wiper activity
Severity 7ActiveconfirmedWeb servers and gateways

Check Point says attackers used PHP2Shell (CVE-2026-109618/109619) on Mobile Access portals for initial access, then the Gaia Dynamic CLI privilege escalation CVE-2026-123039 for root and persistence, Oct 30 to Nov 4. A couple of dozen unpatched systems in one region were hit; some cases were destructive with a ransom-style "Dream Annexation" note and no payment demand. Fix: November Jumbo Hotfix. CISA added CVE-2026-123039 to KEV on Nov 13 (per Grok lane; CISA page did not load for us).

· 40 h ago · blog.checkpoint.com
Sourcesblog.checkpoint.combleepingcomputer.comCISA Known Exploited VulnerabilitiesCISA advisories and alertsBleepingComputer
On X
@BleepinComputerverifiedNov 13, 10:44 UTC

Check Point warns of zero-day flaw exploited for root access

Open on X
@BleepinComputerverifiedNov 13, 16:22 UTC

Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper

Open on X
@DarkWebInformerverifiedNov 13, 17:42 UTC

🚨 Hackers exploit Check Point zero-day to gain root access, deploy backdoors, and wipe VMware servers PoC: https://github.com/googlesky/CVE-2026-123039 Check Point has confirmed active exploitation of CVE-2026-123039, a privilege escalation vulnerability tha

Open on X
Why this score

Plan rubric with caps (verified sweep, Nov 13)

Back to the board

Updated Nov 14, 03:49 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.