Cve 2026 123039 - GoKawiil

Check Point gateway flaws chained to deploy ESXi wiper in Israel-linked attacks

Attackers exploited a pair of critical PHP flaws dubbed PHP2Shell, along with a new Check Point zero-day (CVE-2026-123039), to breach Security Gateway appliances and escalate to root access. Starting October 30, they first struck Israeli organizations and then expanded globally on November 2, installing webshells and a TSGA backdoor before using network scanning tools to pivot into VMware ESXi hosts and deploy a destructive wiper called destroy_v6.

bleepingcomputer.com · 2026-11-13

Check Point issues hotfix for zero-day root-access flaw in Gaia OS

Check Point Software released emergency hotfixes for CVE-2026-123039, a local privilege escalation flaw in the DynamicCLI IPC interface of its Gaia OS, which the company says has been actively exploited since late October against roughly two dozen customers. Attackers reportedly first breached the Mobile Access portal via a PHP2Shell vulnerability, then used the new zero-day to gain root access, deploy webshells and backdoors, and ultimately move to attached VMware ESXi hosts to install wiper malware.

bleepingcomputer.com · 2026-11-13