Security · High impactFan score 67 · Tier A6 sources

U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog

Security Affairs · By Pierluigi Paganini · 3h ago

The Brief · written from 6 sources

Unpatched Check Point Security Gateways were exploited via PHP2Shell flaws for initial access, with a previously reported local privilege escalation in Gaia OS used to gain root.
The attacks deployed the TSGA backdoor and a wiper that erased files on VMware ESXi hosts.
Check Point released emergency hotfixes; the exploitation reportedly began on 30 October.

Why it matters

Check Point gateways sit at network edges, so unpatched devices can give attackers root access, persistence and a path into internal networks. Destructive wiper activity against ESXi hosts can cause data loss and outages.

Who’s affected

Organisations running Check Point Security Gateways
Teams operating VMware ESXi hosts reachable from compromised gateways

What to do

Apply Check Point's emergency hotfixes to all Security Gateways
Check gateways for signs of compromise, including the TSGA backdoor and unexpected root persistence
Verify ESXi hosts and backups for wiper damage

CVE-2026-123039
#security
#check-point
#php2shell
#backdoor
#privilege-escalation
#wiper

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Check Point and UnrealIRCd vulnerabilities to its Known…

Read the full story at securityaffairs.com ↗