Search: CVE-2026-123039

CVE-2026-123039 is a high-severity vulnerability in Checkpoint's Quantum Security Gateway. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. This allows an authenticated local user to send commands to the socket and have them executed with root privileges.

In late October 2026, attackers exploited PHP2Shell vulnerabilities in Check Point Mobile Access portals on Security Gateways, initially targeting Israeli organizations. The attackers gained root privileges, deployed PHP webshells for persistence, installed TSGA malware and TSProxy backdoors, and moved laterally to VMware ESXi infrastructure. The campaign culminated in deploying the destroy_v6 wiper and a politically-themed ransom rejection note. A second wave of scanning targeted organizations worldwide, indicating opportunistic attacks. The toolset is linked to the PhiliKit malware family and possibly Chinese-nexus actors, though attribution is uncertain.

Malware#gogo#privilege escalationIsrael