Unpatched Check Point Gateways Rooted and ESXi Hosts Wiped
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers exploited CVE-2026-123039, a root privilege escalation flaw in Check Point's Gaia OS combined with PHP2Shell vulnerabilities, to fully compromise unpatched gateways and install a persistent backdoor (TSGA). In several cases, the attackers went further and deployed a wiper (destroy_v6) to destroy VMware ESXi hosts, causing severe operational damage. The attacks began targeting unpatched customers within a defined window, underscoring how quickly threat actors weaponize known vulnerabilities against internet-facing security appliances. This incident highlights the critical danger of treating network security appliances as 'set and forget' devices — they require the same rigorous patch discipline as any other system, and arguably more so given their privileged position in the network.
Tactical Insight
Immediate actions
- Apply Check Point's official patch for CVE-2026-123039 to all Gaia OS gateways without delay.
- Audit all Check Point gateways for signs of the TSGA backdoor and destroy_v6 wiper using vendor-provided indicators of compromise.
- Restrict management interfaces of security appliances to dedicated, isolated management networks.
Long-term improvements
- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on internet-facing security infrastructure.
- Maintain a continuously updated inventory of all network appliances, their firmware versions, and patch status.
- Implement network segmentation so that a compromised gateway cannot directly reach hypervisor management interfaces like ESXi.
Detection measures
- Deploy file integrity monitoring and anomaly detection on security appliances to catch unauthorized binary installation such as backdoors.
- Centralize and alert on privileged command execution logs from network appliances to detect root-level activity in real time.
- Ensure ESXi management interfaces are monitored for unusual administrative actions, particularly bulk disk wipe operations.