[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fj2vuPU3D3nKr_6YuPFoZGdmyUJdEI8V72jNzoC2OnqQ":3},{"article":4,"iocs":53,"watch_terms":75,"solutions":76,"lesson":171},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d23c6773-e917-487a-98eb-66a6fcf2743b","CVE-2026-123039: Check Point Gateways Rooted, ESXi Wiped","cve-2026-123039-check-point-gateways-rooted-esxi-wiped-1d7b75","Attackers hit about two dozen unpatched Check Point customers from October 30, starting in Israel, and left the TSGA backdoor behind.","Attackers exploited CVE-2026-123039, a root privilege escalation flaw in Check Point's Gaia OS, combined with PHP2Shell vulnerabilities. This allowed them to gain root access, install a backdoor named TSGA, and in some cases, wipe VMware ESXi hosts with a wiper named destroy_v6. The attacks began on October 30, targeting unpatched customers, with a second wave reaching multiple countries.","CVE-2026-123039 flaw in Check Point Gateways chained with PHP2Shell bugs allows root access, backdoor installation, and","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fcve-2026-123039-check-point-gateway-php2shell-wiper.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fcheckpoint.webp","2026-11-14T01:42:00+00:00","2026-11-14T04:00:08.155764+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Check Point","vendor",{"name":21,"type":22},"Gaia OS","product",{"name":24,"type":22},"Security Gateways",{"name":26,"type":22},"VMware ESXi",{"name":28,"type":29},"UNC5221","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,63,66,69,73],{"type":55,"value":56,"context":57},"cve","CVE-2026-123039","Root privilege escalation flaw in Check Point Gaia OS",{"type":55,"value":59,"context":60},"CVE-2026-109618","PHP2Shell vulnerability",{"type":55,"value":62,"context":60},"CVE-2026-109619",{"type":47,"value":64,"context":65},"TSGA","Backdoor installed by attackers",{"type":47,"value":67,"context":68},"destroy_v6","Wiper used against ESXi hosts",{"type":70,"value":71,"context":72},"ip","130.94.19.204","IP address associated with attacker connections",{"type":70,"value":74,"context":72},"130.94.19.168",[18,21,24],{"controls":77,"vendors":164},[78,106,135],{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,90,98],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":79,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":107,"name":108,"problem":109,"products":110},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":136,"name":137,"problem":138,"products":139},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[140,148,156],{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[165],{"slug":166,"name":18,"logo_path":167,"roles":168},"check-point","\u002Fvendor-logos\u002Fcheck-point.png",[169,170],"affected","reported_by",{"slug":172,"title":173,"body":174,"framework_refs":175,"framework_notes":181},"unpatched-check-point-gateways-rooted-and-esxi-hosts-wiped","Unpatched Check Point Gateways Rooted and ESXi Hosts Wiped","Attackers exploited CVE-2026-123039, a root privilege escalation flaw in Check Point's Gaia OS combined with PHP2Shell vulnerabilities, to fully compromise unpatched gateways and install a persistent backdoor (TSGA). In several cases, the attackers went further and deployed a wiper (destroy_v6) to destroy VMware ESXi hosts, causing severe operational damage. The attacks began targeting unpatched customers within a defined window, underscoring how quickly threat actors weaponize known vulnerabilities against internet-facing security appliances. This incident highlights the critical danger of treating network security appliances as 'set and forget' devices — they require the same rigorous patch discipline as any other system, and arguably more so given their privileged position in the network.",[176,177,178,179,180],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(e)","MITRE ATT&CK T1068: Exploitation for Privilege Escalation",{"NIS2 Article 21(2)(e)":182,"NIST SP 800-53 SI-2: Flaw Remediation":183,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":184,"CIS Control 7: Continuous Vulnerability Management (v8)":185,"MITRE ATT&CK T1068: Exploitation for Privilege Escalation":186},"This provision requires security in acquisition, development, and maintenance including vulnerability handling, which directly covers the obligation to patch known critical flaws in operational network security products like Check Point Gaia OS.","SI-2 mandates that organizations identify, report, and correct information system flaws within defined timeframes; adhering to this control would have ensured the Gaia OS privilege escalation flaw was patched before the attack window opened.","This category requires organizations to contain and mitigate incidents once detected; having pre-defined containment procedures would have limited lateral movement from the compromised gateway to ESXi hosts.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities on all assets, including network appliances — a process that would have identified CVE-2026-123039 and prioritized its patching before attackers exploited it.","The attackers exploited CVE-2026-123039 specifically to escalate from a lower-privileged context to root on the gateway, matching this technique's definition of using a software vulnerability to gain elevated permissions."]