decrypted · 14 november 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

The second flaw that turned a Check Point foothold into root

The Check Point gateway attacks we covered yesterday have since developed. On 13 November CISA, America's cyber agency, added CVE-2026-123039 to its list of flaws known to be exploited in real attacks, with federal agencies told to fix it by 16 November. It is the step that turns a foothold on a firewall into total control.

Two flaws, one staircase

Check Point Research, in a write-up dated 12 November, says an attacker began scanning for unpatched Check Point Security Gateways on 30 October, about a week after a fix became available. The way in was the Mobile Access portal, through the PHP2Shell flaws. That yields only a low-privilege account, a pass for the front desk.

The second flaw is the staircase to the top floor. CVE-2026-123039 sits in an internal interface called DynamicCLI. Security Affairs, reporting the CISA addition, says the root-level daemon listens on a socket that anyone on the machine can write to, and never checks who is knocking. Picture a locksmith's workshop where the master key cabinet obeys any visitor who asks politely.

What the attackers did with root

According to Check Point Research, they placed PHP webshells in the portal's templates directory, launched a backdoor called TSGA and ran a scanner from the gateway. They then moved over SSH, the encrypted administrator login, to a VMware ESXi host, which is the software that runs an organisation's virtual machines. There they ran a wiper called destroy_v6 and left notes that rejected ransom negotiations.

The first wave on 30 October hit Israeli organisations, with destructive activity against some. A second, broader wave on 2 November reached several countries and sectors, with no evidence of destruction. Check Point says the evidence does not allow high-confidence attribution, though the backdoor resembles PhiliKit, which ESET linked to a China-nexus group.

What a defender would see

Check Point describes hundreds of segmentation faults, meaning crashes, in the portal's web workers during exploitation, files named zz*.tpl in the portal's templates directory, and a process called CPconfigdaemon running from the temporary folder. It publishes file hashes and two scanning addresses. An unexpected SSH login from a gateway to a hypervisor is the alarm worth wiring up today.

The Secure by Design lesson

Three design decisions did the damage. A security appliance exposed a rich web portal to the internet. A privileged daemon trusted whoever could reach its socket. And the gateway could log in to the machines holding everything else, so one device sat on the path to the whole estate.

Restrict the portal to the people who need it, and treat any internet-facing appliance as the first thing an attacker will own. Give hypervisor management its own network that gateways cannot reach. And measure your patch time against the attacker's: here the fix was about a week old when the scanning began.

Also this week

Age checks at 16. Ofcom said on 29 October that four methods are currently capable of being highly effective at checking a user is 16 or over: photo ID matching, digital ID services, banking-based checks and facial age estimation. It estimates 94 per cent of UK people aged 16 and over hold a passport or driving licence, and around 150,000 16- and 17-year-olds have neither. Facial estimation can be out by a few years at 16, and the app stores it studied rely on self-declared age. The Government intends to publish its first regulations before the end of 2026. Opinion: whichever method wins, the Secure by Design test is whether a check returns a bare yes or no and then forgets, rather than building a store of children's faces and documents for the next breach.

A ransomware claim with nothing behind it. The Qilin group listed Simply UK, a Scottish property and care home developer, on its leak site on 7 November. The listing carries no screenshots, file samples, ransom demand or deadline, and CyPro, which tracks such claims, treats it as an unconfirmed allegation. CyPro found no public response from the company on the day. Treat it as a claim, not a breach. The practical question for any firm is whether you could say within hours what data you hold and where, because that is exactly what a real claim demands.

An AI-assisted audit, then exploitation. The maintainer of UnrealIRCd, chat server software, said on 8 November that version 6.2.7.1 fixes a command-injection flaw he called the most critical issue found in the software in the past 15 years, discovered in an internal audit "with the help of AI". Security Affairs reports the maintainer then confirmed exploitation attempts, and CISA listed the flaw as exploited on 13 November. It affects 6.0.0 up to but not including 6.2.7.1, on networks with at least two linked servers, and a hot-patch exists for 6.0.0 through 6.2.7. AI helped the defender first here. Attackers will use the same tools, so patch windows will keep shrinking.

Sources

If you want a second pair of eyes on how your gateways and hypervisors are exposed, get in touch.