SockAnalyst
← All playbooks
HighExploited vuln · 2026-11-13

Check Point Gaia CVE-2026-123039: PHP2Shell plus root zero-day exploited on Mobile Access gateways

SockAnalyst · Security+ certified analyst.

What happened

Check Point said on November 12, 2026 that attackers chained PHP2Shell (CVE-2026-109618/CVE-2026-109619, CVSS 9.2, unauthenticated RCE through the Mobile Access Portal) with a new local privilege escalation, CVE-2026-123039 (CVSS 7.8), to get root on internet-facing Security Gateways. The Gaia OS DynamicCLI daemon (dynamic_server) runs as root and listens on a world-writable socket, /tmp/dynamic_socket, executing any command it receives without authenticating the caller. Activity ran from October 30 to November 4 and hit 'a couple of dozen' unpatched systems; the PHP2Shell fix had shipped October 23. Check Point Research says a first wave on October 30 targeted Israeli organizations, some destructively, and a second wave on November 2 spread across countries. Attackers dropped PHP webshells, the TSGA backdoor with a TSProxy component (PhiliKit variants), pivoted over SSH to a VMware ESXi host, ran a destroy_v6 wiper, and left DREAM_ANNEXATION.txt notes with no ransom demand. Attribution is not established.

Update (2026-11-14): Update Nov 14: CISA added CVE-2026-123039 (Check Point Gaia OS DynamicCLI incorrect permission assignment) to the Known Exploited Vulnerabilities catalog on Nov 13, 2026, with a federal due date of Nov 16, 2026 and forensic triage required under BOD 26-04. CISA lists ransomware use as unknown. The PHP2Shell CVEs used for initial access are listed separately. Patch with the November Jumbo Hotfix (sk1000362) and run the hunt checks below on any gateway that was internet-facing with Mobile Access before patching.

Who's affected

Organizations running Check Point Force Firewalls/Security Gateways with Mobile Access enabled and internet-facing, plus Management and Log Servers, Multi-Domain servers and Maestro Orchestrator on R81 through R82.20. Spark Firewalls and Smart-1 Cloud are not affected by CVE-2026-123039.

✅ Fix / patch

  • Install the November Jumbo Hotfix on all Management Servers and Security Gateways (CVE-2026-123039 fixed in R82.20 Take 14, R82.10 Take 52, R82 Take 132, R81.20 Take 174 per sk1000362). Prioritize internet-facing Mobile Access gateways.
  • If you cannot patch yet, stop dynamic_server per sk1000362 (dbset process:dynamic_server, then dbset :save). Dynamic CLI commands in sk144112 will fail until you re-enable it.
  • Confirm the fix: ls -l /tmp/dynamic_socket should show srw-rw---- root config (0660), not srwxrwxrwx (0777).
  • If anything below matches, treat the gateway as compromised: check for PHP webshells in the Mobile Access login-page directory, SSH from the gateway to ESXi hosts, and gaps in firewall logs after a logging-daemon crash.

🔎 Quick hunt check

Check Point published IOCs (below). On the gateway, review /var/log/dynamicCli.log: legitimate requests use the Clish wrapper ('. /opt/CPshared/5.0/tmp/.CPprofile.sh >> /dev/null; export SP_DISTRIBUTE=0; set -o noglob;'), so any command without it may have run as root via the socket. After patching, 'Rejected connection from unauthorized uid' lines mean a blocked attempt. Also look for PHP session files containing upload_progress_pwn, a process named like CPconfigdaemon, scanner or wiper tools under /tmp or /temp, and DREAM_ANNEXATION.txt. The queries below assume gateway syslog (including dynamicCli.log) and firewall logs are forwarded to your SIEM.

MITRE ATT&CK: T1190, T1068, T1505.003, T1021.004, T1485

IOCs

  • IP addresses: 130.94.19[.]204, 130.94.19[.]168
  • Files / paths: PHP session files containing upload_progress_pwn, process/binary named like CPconfigdaemon, scanner or wiper tools under /tmp or /temp, DREAM_ANNEXATION.txt (note referencing Dream Annexation)

Scanning/reconnaissance IPs and host artifacts from Check Point's Nov 12, 2026 advisory. Full IOC list in the Check Point Research report.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=network OR index=firewall OR index=os) ("130.94.19.204" OR "130.94.19.168" OR src_ip IN ("130.94.19.204","130.94.19.168") OR dest_ip IN ("130.94.19.204","130.94.19.168"))
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip, dest_ip, host
| append [ search index=os (source="*dynamicCli.log" "Received" NOT "CPprofile.sh") OR (source="*dynamicCli.log" "Rejected connection from unauthorized uid") OR "upload_progress_pwn" OR "CPconfigdaemon" OR "DREAM_ANNEXATION"
  | stats count min(_time) as first_seen max(_time) as last_seen values(_raw) as evidence by host, source ]
| sort - count
// Check Point CVE-2026-123039 / PHP2Shell: Check Point IOC IPs plus DynamicCLI commands without the Clish wrapper
let IOCIPs = dynamic(["130.94.19.204", "130.94.19.168"]);
let NetHits = CommonSecurityLog
| where TimeGenerated > ago(30d)
| where SourceIP in (IOCIPs) or DestinationIP in (IOCIPs)
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Evidence=make_set(strcat(SourceIP, " -> ", DestinationIP, ":", tostring(DestinationPort)), 25) by Computer=DeviceName;
let HostHits = Syslog
| where TimeGenerated > ago(30d)
| where ((ProcessName has "DynamicCLI" or SyslogMessage has "DynamicCLI") and SyslogMessage has "Received" and not(SyslogMessage has "CPprofile.sh"))
    or SyslogMessage has_any ("Rejected connection from unauthorized uid", "upload_progress_pwn", "CPconfigdaemon", "DREAM_ANNEXATION")
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Evidence=make_set(SyslogMessage, 25) by Computer;
union NetHits, HostHits
| order by Count desc
// Check Point CVE-2026-123039 / PHP2Shell: IOC IPs plus suspicious DynamicCLI and webshell artifacts

See all hunt queries →

⏱ CISA deadline

CVE-2026-123039CVSS 7.8 High (v3.1, CNA)
--
Federal due 2026-11-16 · CISA KEV catalog

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →