Check Point Gaia privilege-escalation flaw CVE-2026-123039 chained with PHP2Shell in attacks to gain gateway root

BleepingComputer reports Check Point said the first exploitation wave targeted Israeli organizations, and a second wave on Nov 2 hit companies in multiple countries and sectors. The attacker installed PHP webshells and the TSGA backdoor and, in the Israeli attacks, moved to VMware ESXi hosts to deploy a wiper called destroy_v6, leaving a DREAM_ANNEXATION.txt note with political messages that rejects ransom negotiations. Check Point tentatively linked TSGA/TSProxy to the PhiliKit framework but said the attacks could not be attributed with confidence; the second wave showed no destructive activity. Besides installing the November Jumbo Hotfix, admins should check previously exposed gateways for session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, unexplained firewall-log gaps, and unauthorized SSH from the gateway to internal ESXi hosts.

“As part of the Check Point campaign , the attackers exploited PHP2Shell for initial access, then targeted CVE-2026-123039, a local privilege escalation in the DynamicCLI process, to gain root access and deploy PHP webshells and establish persistence.”

Trezor says three Trezor Safe 5s bought from CryptoBilis contain the implant, all bought between Aug 20 and Sep 23, 2026 via CryptoBilis’s Tokopedia and Shopee stores or directly, and devices from other resellers or other models showed no tampering .