Check Point has shipped fixes for CVE-2026-123039, a Gaia OS flaw that lets a local user become root and that attackers are already exploiting. CISA added it to its Known Exploited Vulnerabilities catalog on November 13, and Check Point Research says it was the second step in a campaign that started with PHP2Shell and, in some intrusions, ended with a data wiper on VMware ESXi hosts.
What happened
The bug sits in the DynamicCLI service. Its root-level process, dynamic_server, listens on a local socket at /tmp/dynamic_socket that is created world-writable (0777) and never checks who is connecting. Any local user can write a command to it and have it run as root. Check Point rates the flaw CVSS 7.8, stresses that the attacker must already have code running on the appliance, and says it saw exploitation against a couple of dozen customers
.
According to Check Point Research, activity began on October 30, when an attacker scanned for unpatched Security Gateways with exposed Mobile Access portals. The attacker used the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, which PHP patched on October 21) to get in, then CVE-2026-123039 to reach root. From there the attacker planted PHP webshells in the portal’s template folder and installed a persistent backdoor called TSGA with an embedded proxy component, TSProxy.
In the first wave, aimed at Israeli organizations, the attacker scanned the internal network, connected from the gateway to a VMware ESXi host over SSH, and ran a wiper named destroy_v6 that deletes files and tries to overwrite them with zeros first. A note left behind rejects ransom talks. A second wave on November 2 hit organizations in several countries and sectors, and Check Point saw no destructive activity in it.
Check Point links the backdoor code to PhiliKit, a toolset that ESET earlier associated with the China-linked cluster UNC5221. It says the evidence does not support a confident attribution, and that a false flag or an access-broker role are both plausible.
Who is affected
Check Point lists its Force Firewalls, Management and Log Servers, Multi-Domain Security Management, and Maestro Orchestrator on releases R81 through R82.20. Spark Firewalls and Smart-1 Cloud are not affected. The advisory names fixes only for four release lines, shown below. R81 and R81.10 are end-of-support and have no fix listed.
| Release | Fixed in Jumbo Hotfix Accumulator |
|---|---|
| R82.20 | Take 14 or later |
| R82.10 | Take 52 or later |
| R82 | Take 132 or later |
| R81.20 | Take 174 or later |
Federal civilian agencies must remediate by November 16, and CISA marks this entry as requiring forensic triage under its directive BOD 26-04. CISA lists ransomware use as unknown.
What to do
- Install a Jumbo Hotfix at or above the Take numbers above. BleepingComputer reports that Check Point recommends the November Jumbo Hotfix on all management servers and gateways, starting with gateways that expose a Mobile Access portal, because it covers both PHP2Shell and this flaw.
- If you cannot patch yet, Check Point’s workaround is to stop dynamic_server and keep it from restarting: run
dbset process:dynamic_server, thendbset :save. This breaks the Dynamic CLI commands, so plan for that. - After patching, confirm /tmp/dynamic_socket shows permissions 0660 (root, config group) rather than 0777.
- Hunt for compromise. Check /var/log/dynamicCli.log for commands that lack the normal Clish wrapper. Also look for session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, gaps in firewall logs, and SSH from the gateway to ESXi hosts.
- Our analysis: patching closes the door but does not remove implants, so treat any gateway that ran an unpatched, internet-facing Mobile Access portal since late October as possibly compromised. Rotate credentials the gateway could reach, including ESXi service accounts, and confirm you have offline backups of virtual machines.
What we still do not know
Who is behind the campaign is unresolved. Check Point says it is unclear what the attackers did after the second wave, and it has not said how many organizations were breached through the PHP2Shell chain. It also has not said whether the wiper was used outside the first wave. Check Point has not named a motive, though the note references Dream Security, which had recently published PHP2Shell research on attacks against Palo Alto Networks devices.
Sources: Check Point advisory sk1000362 (updated Nov. 12, 2026); Check Point Research, PHP2Shell Exploitation on Check Point Gateway (Nov. 12, 2026); CISA alert (Nov. 13, 2026); CISA KEV catalog (viewed Nov. 14, 2026); BleepingComputer on the zero-day (Nov. 13, 2026); BleepingComputer on the ESXi wiper attacks (Nov. 13, 2026); Cyber Security News (Nov. 14, 2026).
Leave a Reply