JEDI-SEC | Security Research & Digital Defense

Tag: CVE-2026-123039

  • U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog.

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Check Point and UnrealIRCd vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

    Below are the flaws added to the catalog:

    • CVE-2026-114713 UnrealIRCd Improper Neutralization of Delimiters Vulnerability
    • CVE-2026-123039 Check Point Multiple Products Incorrect Permission Assignment for Critical Resource

      CVE-2026-114713 (CVSS score of 8.6) is a high-severity command injection vulnerability in UnrealIRCd, an open-source IRC server software. It affects versions from 6.0.0 up to, but not including, 6.2.7.1.

      The flaw is in the labeled-response module, which fails to properly sanitize the IRCv3 label message tag when including it in server replies. An attacker can exploit this weakness to inject newlines and additional commands into server-to-server communications. On networks with at least two linked servers, even an ordinary user with no special privileges can execute commands with server-level authority. This could allow them to perform privileged IRC operations, such as disconnecting users or banning them from the network.

      The UnrealIRCd maintainer confirmed that attackers were already attempting to exploit the vulnerability on the internet shortly after its disclosure. However, no specific threat group or attacker identity has been publicly identified, and there is no confirmed evidence linking the attacks to a particular campaign or financial motive. The vulnerability could be abused to gain administrative control over IRC networks, manipulate users and channels, or disrupt IRC services.

      CVE-2026-123039 (CVSS score of 7.8) is a high-severity local privilege escalation vulnerability affecting Check Point Security Gateways and Security Management products. The flaw resides in the Gaia OS DynamicCLI daemon, which runs with root privileges and listens on a local, world-writable Unix socket (/tmp/dynamic_socket) without properly authenticating connecting processes. An authenticated local attacker with low privileges can exploit this weakness to execute arbitrary commands as root, gaining full control over the affected device.

      Threat actors are actively exploiting the vulnerability in attacks against unpatched Check Point gateways. According to Check Point Research, attackers first gain initial access through the Mobile Access portal by exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), then leverage CVE-2026-123039 to escalate privileges to root. They subsequently deploy webshells and the TSGA backdoor, establish persistence, move laterally into internal networks, and, in some cases, deploy the destroy_v6 wiper to erase data on VMware ESXi hosts.

      The campaign initially targeted Israeli organizations on October 30, 2026, with destructive attacks reported against some victims. A second wave on November 2 expanded to organizations across multiple countries and sectors.

      Attribution remains uncertain. The malware shares code and infrastructure characteristics with PhiliKit, a framework previously associated with UNC5221, a China-linked threat actor. However, Check Point cautions that the evidence is insufficient to confidently attribute the entire campaign to this group. Possible explanations include collaboration with another actor or a false-flag operation.

      According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

      Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

      CISA orders federal agencies to fix the two vulnerabilities by November 16, 2026.

      Follow me on Twitter: @securityaffairs and Facebook and Mastodon

      Pierluigi Paganini

      (SecurityAffairs – hacking, CISA)

      Source: Security Affairs · 2026-11-14

    • Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

      Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell

      Unpatched Check Point gateways were hacked worldwide, leading to root access, backdoors, network intrusion and destructive wiper attacks.

      Starting on 30 October, an attacker scanned and exploited Check Point Security Gateways that hadn’t been patched, going in through the Mobile Access portal. Check Point Research describes the activity as PHP2Shell for initial access, followed by a root-level privilege escalation tracked as CVE-2026-123039. The activity began about a week after a fix became available, from an IP address ending in 130.94.19[.]204.

      “We have now confirmed that, in late October 2026, approximately one week after a security fix became available, activity originating from 130.94.19[.]204 targeted Israeli organizations through vulnerable Mobile Access portals on Check Point Security Gateways. Evidence suggested some cases of a successful compromise, with exploitation activity consistent with PHP2Shell, associated with CVE-2026-109618 and CVE-2026-109619.” reads the report. “Following initial access, the attacker escalated privileges from the portal service account to root by exploiting CVE-2026-123039, a local privilege-escalation vulnerability in the DynamicCLI IPC interface. The attacker then used privileged command execution to deploy PHP webshells and establish persistence.”

      There were two waves. The first, on 30 October, hit Israeli organizations, and some suffered destructive attacks. The second, on 2 November, reached organizations in several countries and sectors with no sign of destruction, and neither wave favored a particular sector. That points to opportunistic scanning, not careful targeting.

      The first signs of the attack were PHP session files found in the /opt/CPcvpn-R81.20/tmp/ folder. These files contained a marker named upload_progress_pwn. The portal’s Apache and PHP processes also crashed hundreds of times, suggesting repeated attempts to exploit the vulnerability. The attacker then exploited another local flaw in the DynamicCLI interface to gain root privileges, giving them full control of the device.

      With root access, the attackers installed PHP webshells in the folder used by the portal to create login pages. These files had names starting with zz and ending in .tpl. Initially, they contained simple tools for running commands. The attackers later replaced them with more advanced versions that required a hardcoded key, could execute system commands and PHP code, and supported file uploads. Uploaded files were first saved as /tmp/.up.tpl and then copied into the portal’s folder under the name challenge_render.tpl.

      The attackers then installed a separate backdoor called TSGA, launched from /tmp/CPconfigdaemon. Running with root privileges, it moved itself, restarted under the name slot_CPconfigdaemon, and installed a second tool called TSProxy at /lib/libcpfwcommon.so. TSProxy was designed to run inside processes on the Check Point appliance and monitor network activity. It intercepted selected network connections used by the attackers while leaving normal network traffic unaffected.

      TSGA is built for Check Point gear. It offers encrypted remote access, configuration theft, persistence through backups and snapshots, process injection and tampering with binary firewall logs. TSProxy adds encrypted proxying.

      From the gateway, the attackers ran the gogo scanner to map the internal network, then moved over SSH to a VMware ESXi host using the vpxuser account. There they staged a Linux wiper, destroy_v6, and ran it. It deletes files in a target folder regardless of extension, overwrites them with zeros first unless run in fast mode, and can skip listed folders.

      The wiper also leaves a note named DREAM_ANNEXATION.txt in each folder it processes. The note is politically themed, includes a timestamp, is written in Hebrew with reference to the Israeli-Palestinian conflict, and rejects ransom talks. At least nobody has to haggle.

      Attribution is more difficult. TSGA and TSProxy appear to be modified versions of PhiliKit, a framework previously found in attacks against Ivanti devices and linked by ESET to UNC5221, a China-linked threat group. The tools share several unique features with PhiliKit, including code, configuration settings and encryption details. These similarities include the use of TCP port 11072 and a Unix socket at /tmp/.p_sock. TSProxy also uses the same credentials, communication secrets, TLS certificate and private key as a PhiliKit component called libdssafe.so.

      Other findings also suggest a possible connection to Chinese threat actors. The gogo network scanner has previously been associated with China-linked groups, while the attackers used LightNode VPS servers, a hosting provider also used by these actors. The scanning activity took place between 00:00 and 09:00 UTC, corresponding to normal working hours in China (08:00 to 17:00).

      However, some aspects of the operation do not match UNC5221’s known activity and objectives. These include the destructive attacks, the focus on Israeli organizations, the Hebrew-language message left by the wiper and the malware name, which appears to reference the word “Philistine”.

      Check Point says several explanations are possible. UNC5221 may have carried out the entire operation, or it may have provided initial access to another threat actor. The attackers could also have deliberately left clues to mislead investigators. Another possibility is that the destructive attacks were intended to hide a different objective.

      The note uses the Dream Security brand, and Dream recently published research on PHP2Shell attacks on Palo Alto Networks devices by China-nexus actors. That timing raises the possibility of retaliation, but the evidence doesn’t establish a clear motive.

      “Taken together, the evidence does not allow us to assess with high confidence the true nature of this operation. Several scenarios remain plausible: the identified actor ran the entire campaign, acted solely as an initial access broker, or took part in a false-flag operation.” concludes the report. “It is also possible that the destructive activity served as a smoke screen.”

      Follow me on Twitter: @securityaffairs and Facebook and Mastodon

      Pierluigi Paganini

      (SecurityAffairs – hacking, PHP2Shell)

      Source: Security Affairs · 2026-11-13