Attackers rooted Check Point gateways through the Mobile Access portal and wiped servers behind them. Install the new hotfix.
Check Point says attackers used the PHP2Shell flaws in the Mobile Access portal, then a new root bug in Gaia's DynamicCLI service, CVE-2026-123039, to backdoor Security Gateways and wipe a VMware ESXi host. It has emergency hotfixes for R81 through R82.20 and saw the root exploit used against a couple of dozen customers.











