Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Check Point Software released emergency hotfixes on Thursday after detecting an actively exploited high-severity vulnerability tracked as CVE-2026-123039. The company observed hackers exploiting the flaw against a couple of dozen customers since late October to secure root privileges and establish persistence on compromised equipment. [1]
The bug resides in the DynamicCLI IPC interface of Gaia OS, where the dynamic_server daemon runs as root and monitors a world-writable local socket without authenticating connecting processes. According to Check Point and SecurityWeek, attackers initially gained access to the Mobile Access portal via the PHP2Shell vulnerability, used CVE-2026-123039 to elevate permissions to root, planted webshells alongside TSGA backdoor and TSProxy malware, and subsequently moved to a VMware ESXi host to deploy destructive wiper malware. [1][2]
The flaw impacts Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server systems. For administrators unable to patch immediately, Check Point recommended halting the dynamic_server process and blocking it from restarting as a temporary measure. [1]
Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October.
via BleepingComputerPHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
via SecurityWeek