CVE-2026-123039: Check Point Gateways Rooted, ESXi Wiped

Attackers exploited CVE-2026-123039, a root privilege escalation flaw in Check Point's Gaia OS combined with PHP2Shell vulnerabilities, to fully compromise unpatched gateways and install a persistent backdoor (TSGA). In several cases, the attackers went further and deployed a wiper (destroy_v6) to destroy VMware ESXi hosts, causing severe operational damage. The attacks began targeting unpatched customers within a defined window, underscoring how quickly threat actors weaponize known vulnerabilities against internet-facing security appliances. This incident highlights the critical danger of treating network security appliances as 'set and forget' devices — they require the same rigorous patch discipline as any other system, and arguably more so given their privileged position in the network.