Vulnerabilities · 3h ago
Check Point says attackers used PHP2Shell and a Gaia OS privilege-escalation flaw in two waves beginning October 30 and November 2, 2026, compromising Security Gateways and, in some intrusions, wiping VMware ESXi hosts. The first wave targeted Israeli organizations; the second spread across multiple countries, with no destructive activity observed.
PHP2Shell gave attackers a way to run code on a gateway. They then abused CVE-2026-123039: Gaia’s root-running DynamicCLI service accepts commands through a local socket without checking which process sent them. That let code already running on the appliance gain root access, plant persistent backdoors, and, in some cases, reach an ESXi host over SSH and run a wiper.
If a compromised gateway can reach ESXi, the incident’s scope can extend from network appliances to the hypervisors and files they host. China-linked indicators have not settled who was behind the campaign or whether destructive activity served as a cover, so attribution remains uncertain even as the impact is clear.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29 · date passed
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: pHP has various global state that temporarily points into request memory. EPSS 100% (100th percentile).
CISA federal remediation date Oct 29 · date passed
Published Nov 12 by Check Point Software
CVSS 7.8 HIGH: the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes.
2 sources covering this story
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
Hackers exploit Check Point gateway flaws to deploy the TSGA backdoor, with some intrusions leading to destructive attacks on ESXi hosts.
PHP2Shell Exploited in Destructive Check Point Gateway Attacks
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Part of the PlainSec briefing for 2026-11-13