GoKawiilCheck Point issues hotfix for zero-day root-access flaw in Gaia OS
Check Point Software released emergency hotfixes for CVE-2026-123039, a local privilege escalation flaw in the DynamicCLI IPC interface of its Gaia OS, which the company says has been actively exploited since late October against roughly two dozen customers. Attackers reportedly first breached the Mobile Access portal via a PHP2Shell vulnerability, then used the new zero-day to gain root access, deploy webshells and backdoors, and ultimately move to attached VMware ESXi hosts to install wiper malware.