Check Point Gaia OS Security Gateways Exploited via PHP2Shell and Dynamic CLI Zero-Day

Beginning October 30, 2026, threat actors compromised Check Point Security Gateways running Gaia OS by chaining unauthenticated remote code execution in the Mobile Access portal (CVE-2026-109618, CVE-2026-109619) with a Gaia OS local privilege escalation zero-day (CVE-2026-123039) that abuses the Dynamic CLI IPC interface to obtain root. Attackers deployed TSGA and TSProxy backdoors, embedded web shells in login-page templates, exfiltrated firewall configurations, tampered with logs, pivoted via SSH to VMware ESXi, and deployed the destroy_v6 wiper. A couple of dozen customers were impacted; emergency hotfixes and dynamic_server process isolation are required.

• Incident Overview & Timeline

  • Activity began October 30, 2026, with initial targeting focused on Israeli organizations before broader follow-on activity.
  • Approximately two dozen Check Point customers confirmed impacted.
  • Intrusion claimed by threat actor Dream Security Ltd, accompanied by politically themed messaging.
  • Campaign combined edge gateway compromise with destructive wiper deployment on virtualization infrastructure.

• Exploitation Chain & Vulnerability Mechanics

  • Unauthenticated RCE against Mobile Access portal via PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2).
  • Local privilege escalation to root via CVE-2026-123039, abusing the Gaia OS Dynamic CLI Inter-Process Communication interface and dynamic_server daemon.
  • Root access enabled deployment of TSGA backdoor and TSProxy malware across gateway appliances.
  • Chained vulnerabilities converted unauthenticated internet-facing access into full appliance compromise.

• Malware, Persistence, and Post-Exploitation

  • TSGA and TSProxy deployed for persistent remote access and traffic proxying.
  • Web shells embedded in login-page templates to maintain access.
  • Persistence embedded in backups, snapshots, and appliance processes; survives reboots.
  • Firewall configurations exfiltrated; logs altered for anti-forensics; lateral movement to VMware ESXi via SSH.

• Impact & Affected Assets

  • Affected products: Check Point Firewall, Security Gateway, Security Management Server, Multi-Domain Security Management Server, Scalable Platforms.
  • Consequences include root privilege escalation on Gaia OS, network blueprint theft, and destroy_v6 wiper execution on ESXi hosts.
  • Erosion of trust in security appliances; edge devices now require critical infrastructure-level rigor.

• Detection & Mitigation

  • Apply emergency hotfixes for CVE-2026-123039 and patch PHP2Shell CVEs immediately.
  • Stop and prevent restart of the dynamic_server Gaia OS daemon.
  • Disable Mobile Access portal where not required; keep management interfaces off the internet.
  • Ship firewall logs off-box in real time and segment networks to cut trusted paths between gateways and VMware ESXi.

• Conclusion

  • This campaign demonstrates that perimeter security appliances are high-value targets for initial access and destructive operations.
  • Immediate patching and process-level containment are mandatory for exposed Check Point gateways.
  • Defenders should assume gateway compromise and validate ESXi isolation and backup integrity.