Check Point Gaia OS Security Gateways Exploited via PHP2Shell and Dynamic CLI Zero-Day
Beginning October 30, 2026, threat actors compromised Check Point Security Gateways running Gaia OS by chaining unauthenticated remote code execution in the Mobile Access portal (CVE-2026-109618, CVE-2026-109619) with a Gaia OS local privilege escalation zero-day (CVE-2026-123039) that abuses the Dynamic CLI IPC interface to obtain root. Attackers deployed TSGA and TSProxy backdoors, embedded web shells in login-page templates, exfiltrated firewall configurations, tampered with logs, pivoted via SSH to VMware ESXi, and deployed the destroy_v6 wiper. A couple of dozen customers were impacted; emergency hotfixes and dynamic_server process isolation are required.
PHP2Shell: Chained RCE Compromises PHP Web Infrastructure and Broadcom VMware ESX Hypervisors
PHP2Shell is a critical, pre-authentication remote-code-execution chain targeting the PHP runtime by combining CVE-2026-109618 (OOM memory corruption during multipart request cleanup) and CVE-2026-109619 (use-after-free via stale session upload-progress state). Exploitation occurs prior to application-level execution, significantly impacting Apache mod_php environments. Observed attacks have successfully pivoted from PHP-based web servers to Broadcom VMware ESX hypervisors, compromising approximately 25 servers, including U.S. government-linked infrastructure. Despite emergency patches released in October 2026, telemetry from OX Security indicates a severe remediation gap, with over 99% of exposed instances remaining unpatched.