Check Point patches a zero-day used to take root on gateways in attacks that wiped Israeli systems - MLQ.ai
Check Point Software released emergency hotfixes for a high-severity zero-day vulnerability, CVE-2026-123039, that attackers have used since late October to gain root privileges on its security gateways.
The vulnerability exists in the DynamicCLI interface, where a root-level daemon called dynamic_server listens on a world-writable local socket without authenticating connecting processes. This allows any local user who reaches it to run commands as root. Affected products include Check Point's Firewall, Security Gateway, Scalable Platforms, Security Management Server, and Multi-Domain Security Management Server.
Customers unable to install the hotfix immediately should stop the dynamic_server process and prevent it from restarting. Check Point has published indicators of compromise to help organizations detect potential breaches.
Attackers' methods
Attackers initially gained access through PHP2Shell, a pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that were patched on Oct. 21. They placed PHP webshells in a directory used by the Mobile Access portal to build login pages, then exploited CVE-2026-123039 to become root and installed the TSGA backdoor and TSProxy, variants of the PhiliKit malware framework.
Wiper attacks
In the first wave beginning Oct. 30, attackers targeted Israeli organizations, mapped internal networks, moved laterally to VMware ESXi hosts, and deployed a wiper malware. A second wave from Nov. 2 hit Check Point gateways in multiple countries, including some of the same Israeli victims, but without destructive activity.
Check Point found no clear sector preference in the attacks. The activity occurred during typical Chinese working hours and used China-linked malware and infrastructure, but the wiper doesn't match known Chinese operations. The company cannot determine with high confidence whether the actor ran the whole campaign, sold access, or staged a false flag. Attackers left a note mentioning Dream Security.
Other vendors affected
Citrix fixed 28 NetScaler vulnerabilities on Nov. 12, including 10 critical ones. Nine were critical memory-overflow bugs that could cause unpredictable behavior or denial of service, plus a critical flaw in NetScaler Console (CVE-2026-120869, CVSS 9.4) that could let unauthenticated attackers reach restricted resources. Citrix reported no exploitation of these vulnerabilities.
Meanwhile, attackers began exploiting a new N-able N-central zero-day, dubbed 4EverAble2Shell, within hours of researcher Sean Bales publishing a proof-of-concept on GitHub on Nov. 12. The vulnerability (CVE-2026-90436, CVSS 9.8) allows unauthenticated attackers to execute root code on N-central servers with the Legacy API enabled. Security firms Lupovis and Huntback observed compromises about five hours after publication, with attackers installing XMRig cryptocurrency miners.
Related
