--- title: The firewall becomes the foothold: Attackers turn Check... description: Attackers chained the PHP2Shell flaws with a new privilege escalation bug, CVE-2026-123039, to seize root access on Check Point gateways. The vulnerability... canonical: https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The firewall becomes the foothold: Attackers turn Check Point gateways against customers | daily.dev og:description: Attackers chained the PHP2Shell flaws with a new privilege escalation bug, CVE-2026-123039, to seize root access on Check Point gateways. The vulnerability... og:url: https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx og:image: https://api.daily.dev/og/posts/Wtut8F5Dx.png og:image:alt: The firewall becomes the foothold: Attackers turn Check Point gateways against customers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The firewall becomes the foothold: Attackers turn Check Point gateways against customers **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary Attackers chained the PHP2Shell flaws with a new privilege escalation bug, CVE-2026-123039, to seize root access on Check Point gateways. The vulnerability lets attackers send commands to the Gaia OS Dynamic CLI daemon and has been exploited since late October, hitting a couple of dozen customers. Attackers first breached the Mobile Access portal via PHP2Shell (CVE-2026-109618 and CVE-2026-109619, rated 9.2), then escalated to root, planted TSGA backdoors and TSProxy malware, pivoted to a VMware ESXi host over SSH, and deployed the destroy_v6 wiper. A group calling itself Dream Security Ltd left political messages during the destructive stage. Check Point has released hotfixes and urges immediate patching, especially for internet-facing Mobile Access devices. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-123039 and which Check Point products does it affect? CVE-2026-123039 is a 7.8-rated local privilege escalation flaw in the Dynamic CLI IPC interface that sends privileged command requests to the root-level Gaia OS Dynamic CLI daemon. It affects Check Point's Firewall, Multi-Domain Security Management Server, Security Gateway, Security Management Server, and Scalable Platforms. Exploitation requires existing local code execution, typically gained first via PHP2Shell. _Teams patching gateway vulnerabilities track emergency advisories like this one on daily.dev._ ### How did attackers combine PHP2Shell with the Check Point zero-day to compromise gateways? Attackers first gained access to the Mobile Access portal by exploiting PHP2Shell, two critical unauthenticated RCE PHP flaws rated 9.2 (CVE-2026-109618 and CVE-2026-109619). They then escalated privileges to root using the CVE-2026-123039 zero-day, hid web shells in login page templates, and installed TSGA backdoor and TSProxy malware that survives reboots and hides in backups and snapshots. _Anyone piecing together an exploit chain like this can follow the breakdown on daily.dev._ ### What did attackers do after gaining root access on the compromised Check Point gateways? After gaining root, attackers pivoted from the compromised gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed messages signed by a group calling itself Dream Security Ltd. The backdoor also copied firewall configurations, essentially the network blueprint, and altered logs to conceal activity. _Incident responders mapping lateral movement from firewall to hypervisor can keep up with cases like this on daily.dev._ ## Similar posts on daily.dev - [New Check Point flaw lets hackers execute code with root privileges](https://daily.dev/posts/new-check-point-flaw-lets-hackers-execute-code-with-root-privileges-wi9m2bohy) · BleepingComputer · 0 upvotes · 0 comments - [One Port to Root: Weaponizing Check Point Management CVE-2026-93616](https://daily.dev/posts/one-port-to-root-weaponizing-check-point-management-cve-2026-93616-foy8qulzb) · Sliver C2 Documentation · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The firewall becomes the foothold: Attackers turn Check Point gateways against customers","url":"https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx"},"datePublished":"2026-11-14T01:43:41.821Z","dateModified":"2026-11-14T02:04:48.467Z","description":"Attackers chained the PHP2Shell flaws with a new privilege escalation bug, CVE-2026-123039, to seize root access on Check Point gateways. The vulnerability...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f973c351d61fd564117e74fe4d5efb13?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f973c351d61fd564117e74fe4d5efb13?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"The firewall becomes the foothold: Attackers turn Check Point gateways against customers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers-wtut8f5dx#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-123039 and which Check Point products does it affect?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-123039 is a 7.8-rated local privilege escalation flaw in the Dynamic CLI IPC interface that sends privileged command requests to the root-level Gaia OS Dynamic CLI daemon. It affects Check Point's Firewall, Multi-Domain Security Management Server, Security Gateway, Security Management Server, and Scalable Platforms. Exploitation requires existing local code execution, typically gained first via PHP2Shell. Teams patching gateway vulnerabilities track emergency advisories like this one on daily.dev."}},{"@type":"Question","name":"How did attackers combine PHP2Shell with the Check Point zero-day to compromise gateways?","acceptedAnswer":{"@type":"Answer","text":"Attackers first gained access to the Mobile Access portal by exploiting PHP2Shell, two critical unauthenticated RCE PHP flaws rated 9.2 (CVE-2026-109618 and CVE-2026-109619). They then escalated privileges to root using the CVE-2026-123039 zero-day, hid web shells in login page templates, and installed TSGA backdoor and TSProxy malware that survives reboots and hides in backups and snapshots. Anyone piecing together an exploit chain like this can follow the breakdown on daily.dev."}},{"@type":"Question","name":"What did attackers do after gaining root access on the compromised Check Point gateways?","acceptedAnswer":{"@type":"Answer","text":"After gaining root, attackers pivoted from the compromised gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed messages signed by a group calling itself Dream Security Ltd. The backdoor also copied firewall configurations, essentially the network blueprint, and altered logs to conceal activity. Incident responders mapping lateral movement from firewall to hypervisor can keep up with cases like this on daily.dev."}}]} ```