Check Point has confirmed attacks against unpatched Security Gateways that escalated from vulnerable web portals into root-level access, with destructive activity reaching VMware ESXi systems in some cases. The company published its investigation on November 12, 2026. One day later, the U.S. Cybersecurity and Infrastructure Security Agency added the associated Gaia operating-system flaw, CVE-2026-123039, to its Known Exploited Vulnerabilities catalog.

Official Check Point Software video introducing its Quantum Force firewall family, published April 15, 2024. General product context only; the video predates the 2026 intrusions and does not document the attacks. Credit: Check Point Software / YouTube.

A two-stage compromise of perimeter security

According to Check Point Research’s technical investigation, the first attacks appeared on October 30 against exposed Mobile Access portals. The attackers used PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to gain initial access, then exploited CVE-2026-123039 in the Gaia DynamicCLI service to elevate privileges. The Gaia flaw carries a vendor-reported CVSS 7.8 severity rating; the two PHP2Shell issues are listed at 9.2.

Check Point says fixes were available on October 23, before the observed campaign, and describes roughly a couple of dozen compromised, unpatched systems in one region. Its researchers also observed broader scanning on November 2 across organizations in multiple countries. A scanned system should not be counted as a confirmed breach.

The local escalation bug is not equivalent to an independently demonstrated, unauthenticated, internet-to-root exploit. Attackers in the documented incidents first obtained a foothold through the exposed web interface. Combining the vulnerabilities let them cross the privilege boundary into root-controlled processes.

Investigators identify backdoors and a hypervisor wiper

After gaining elevated access, investigators found PHP webshells and a persistent backdoor known as TSGA, accompanied by a TSProxy networking component. In one investigated sequence, attackers moved over SSH from the compromised gateway to a VMware ESXi host and deployed a destructive tool called destroy_v6. Some incidents included a politically themed note, but the research does not establish a reliable perpetrator or motive.

The vendor notes that destructive activity affected a limited subset of the attacks. Its researchers found technical similarities between the backdoor and previously reported malware, but explicitly caution against high-confidence attribution. CISA lists ransomware-campaign use for the Gaia CVE as unknown; a destructive attack alone does not prove a ransomware operation.

Administrators face a short remediation window

Check Point recommends applying the November Jumbo Hotfix to affected Security Gateways and Management Servers, prioritizing internet-facing Mobile Access deployments. The vendor identifies Gaia R81.20, R82, R82.10 and R82.20 among affected versions for the privilege-escalation flaw. Operators should also consult product-specific advisories, investigate suspicious sessions and unexpected gateway persistence, and retain relevant forensic evidence.

CISA’s exploited-vulnerability listing sets November 16, 2026 as the federal remediation deadline under Binding Operational Directive 26-04. The directive’s mandatory federal scope should not be confused with a universal legal deadline for private enterprises. Nevertheless, perimeter systems with documented exploitation warrant prompt review.

Recent BitcoinVersus.Tech reporting has covered the earlier PHP2Shell disclosure, a previous GitLab exploitation warning, and Brotli decoder vulnerability. Related coverage of industrial controller security updates and government guidance for industrial-system defense underscores the need to patch exposed management and operational infrastructure without assuming perimeter appliances are immune to compromise.

Bottom line: Check Point’s November disclosure documents a real intrusion chain progressing from web-portal exploitation to privileged firewall access and, in some incidents, destruction beyond the gateway. Patching is necessary, but already compromised devices also require investigation and remediation.

Primary sources: Check Point’s November 12 vendor advisory; Check Point Research’s incident investigation; CISA’s November 13 KEV entry; official Check Point Quantum Force product video; BleepingComputer independent coverage, November 13. Claims about compromise counts and malware behavior remain attributed to the vendor investigation.

Editor’s Note: Confirmed vendor findings describe roughly two dozen compromised unpatched systems in a single region; additional worldwide scanning should not be presented as an equal number of successful breaches. The Gaia vulnerability is a local privilege-escalation issue chained with PHP2Shell in the documented intrusions. A destructive tool on VMware ESXi was observed in a subset of cases, not across every exposed firewall. Suspected attacker affiliation and motivation are unresolved. The 1200 × 630 colored-pencil featured cover depicts a conceptual security operations scene rather than an identified victim facility. The two in-story security illustrations originate from Check Point, and the official 2024 YouTube product video is historical background, not attack footage. Video playback, mobile presentation, and independent device testing are not presumed from saved markup.

BitcoinVersus.Tech is volunteer-run and publishes independent educational technology reporting. An optional 5,000-satoshi donation supports ongoing research. Scan the original QR from a second screen with a compatible Bitcoin wallet; on mobile, use a wallet that supports scanning a saved image. Independently verify the recipient address 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb and the payment amount before sending. Bitcoin transfers are generally irreversible.

We volunteer daily to ensure information on the BitcoinVersus.Tech platform is Verifiably True. Coverage is educational and informational and does not constitute financial or investment advice.