FlagThis — Daily Cybersecurity Intelligence Briefing

Beginning October 30, 2026, threat actors compromised Check Point Security Gateways running Gaia OS by chaining unauthenticated remote code execution in the Mobile Access portal (CVE-2026-109618, CVE-2026-109619) with a Gaia OS local privilege escalation zero-day (CVE-2026-123039) that abuses the Dynamic CLI IPC interface to obtain root. Attackers deployed TSGA and TSProxy backdoors, embedded web shells in login-page templates, exfiltrated firewall configurations, tampered with logs, pivoted via SSH to VMware ESXi, and deployed the destroy_v6 wiper. A couple of dozen customers were impacted; emergency hotfixes and dynamic_server process isolation are required.