Hackers have chained Check Point firewall vulnerabilities to gain root access, plant backdoors, and deploy destructive malware on a VMware ESXi host.
The campaign began on October 30, 2026, targeting Israeli organizations before expanding worldwide. Check Point confirmed that attackers exploited the privilege escalation flaw against a couple of dozen customers.
The supplied investigation describes two waves. The first included destructive activity against some Israeli targets. A second wave on November 2 reached organizations across several countries and sectors, with no evidence of data destruction. Neither wave showed a clear industry focus.
Attackers gained initial access through vulnerable Check Point Mobile Access portals, using PHP2Shell exploitation linked to CVE-2026-109618 and CVE-2026-109619. After reaching the portal service account, attackers exploited CVE-2026-123039 to run commands as root.
The flaw, rated 7.8, affects the Gaia operating system’s…
