Security · High impactFan score 67 · Tier A6 sources

Check Point warns of zero-day flaw exploited for root access

BleepingComputer · By Sergiu Gatlan · 1d ago

The Brief · written from 6 sources

Unpatched Check Point Security Gateways were exploited via PHP2Shell flaws for initial access, with a previously reported local privilege escalation in Gaia OS used to gain root.
The attacks deployed the TSGA backdoor and a wiper that erased files on VMware ESXi hosts.
Check Point released emergency hotfixes; the exploitation reportedly began on 30 October.

Why it matters

Check Point gateways sit at network edges, so unpatched devices can give attackers root access, persistence and a path into internal networks. Destructive wiper activity against ESXi hosts can cause data loss and outages.

Who’s affected

Organisations running Check Point Security Gateways
Teams operating VMware ESXi hosts reachable from compromised gateways

What to do

Apply Check Point's emergency hotfixes to all Security Gateways
Check gateways for signs of compromise, including the TSGA backdoor and unexpected root persistence
Verify ESXi hosts and backups for wiper damage

CVE-2026-123039
#security
#check-point
#php2shell
#backdoor
#privilege-escalation
#wiper

Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. [...]

Read the full story at bleepingcomputer.com ↗