Check Point has released emergency hotfixes for a high-severity flaw, CVE-2026-123039, that has already been used in attacks, BleepingComputer reports. The company said it has seen the bug exploited against a couple of dozen customers since late October, to gain root privileges and persist on affected devices.
The affected products include Check Point’s Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway and Security Management Server. In a separate report, Check Point said attackers first got into the Mobile Access portal by exploiting the earlier PHP2Shell issues, then used this flaw to escalate to root. From there, some attacks went further into the environment. If you run these products, apply the hotfix now, and read the advisory for compromise-checking guidance. If you can’t deploy the hotfix immediately, Check Point also published a temporary mitigation in that same advisory.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
My take
This one is already being used. Don’t wait for a tidy change window. Get the hotfix on, follow Check Point’s checking steps, and if you also had Mobile Access exposed, treat this as an incident review, not just a patch Tuesday item.
Update, Nov. 13 afternoon: the attacks ended with a wiper on ESXi
BleepingComputer now has more on what the attackers did once they were in. Check Point says the campaign began Oct. 30 against Israeli organizations, with a second wave on Nov. 2 hitting companies in several countries. After PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and CVE-2026-123039 for root, they installed PHP webshells and a backdoor called TSGA with a TSProxy component that hides commands in normal traffic. In the Israeli attacks they used the open-source gogo scanner to find VMware ESXi hosts, then ran a wiper called destroy_v6 that tries to zero-fill data before deleting it. A note left on one host had political messages and rejected ransom talks, so the goal was damage, not money; researchers say the messaging raises questions about a possible false flag.
One edge box became a path to the hypervisors. After you patch, ask whether your gateways can even reach your ESXi management network. They probably shouldn’t.
God Bless, and Use the Source!
References & Further Reading
- Check Point patches a zero-day that lets attackers get root access (BleepingComputer)
- Check Point advisory SK1000362
- Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper (BleepingComputer)
- PHP2Shell Exploited in Destructive Check Point Gateway Attacks (SecurityWeek)
- Hackers Exploit PHP2Shell Flaws in Check Point Gateways (The Hacker News)
