CVE-2026-123039 lets a local user run commands as root on Check Point gateways and management servers; Check Point says it has been exploited against a couple of dozen customers since late October [1] .
In a wave that began Oct. 30, attackers hit Israeli organizations, moved from gateways to VMware ESXi hosts and deployed a wiper; a second wave from Nov. 2 hit gateways in several countries without destruction [2] .
Citrix fixed 28 NetScaler vulnerabilities, 10 of them critical, with no exploitation reported; an N-able N-central zero-day was exploited five hours after a public exploit appeared [3] [4] .
Check Point Software released emergency hotfixes for a high-severity zero-day, CVE-2026-123039, that attackers have used since late October to gain root privileges and persistence on its security gateways [1] . The company says it has seen "an active exploit of this vulnerability against a couple of dozen customers" [1] . Affected products include its Firewall, Security Gateway, Scalable Platforms, Security Management Server and Multi-Domain Security Management Server; the advisory is support article sk1000362 [1] .
The bug sits in the DynamicCLI interface: a root-level daemon, dynamic_server, listens on a world-writable local socket and does not authenticate the processes that connect to it, so any local user who reaches it can run commands as root [1] . Customers that cannot install the hotfix right away should stop the dynamic_server process and prevent it from restarting; Check Point has published indicators of compromise [1] .
From PHP2Shell to a wiper
Attackers got their first foothold through PHP2Shell, the pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) patched on Oct. 21 that CISA confirmed were being exploited days later [2] . They placed PHP webshells in a directory the Mobile Access portal uses to build its login pages, used CVE-2026-123039 to become root, and installed the TSGA backdoor and TSProxy, variants of the PhiliKit malware framework [2] . The same tools had earlier been seen in attacks on Ivanti appliances [1] .
In the first wave, which began Oct. 30 and targeted Israeli organizations, the attackers mapped internal networks, moved laterally to VMware ESXi hosts and ran a wiper [2] . A second wave from Nov. 2 hit Check Point gateways in multiple countries, including some of the same Israeli victims, without destructive activity [2] . Check Point found no clear sector preference. The activity ran during typical Chinese working hours and used China-linked malware and infrastructure, but the wiper does not match known Chinese operations, and the company said it cannot judge with high confidence whether the actor ran the whole campaign, only sold access, or staged a false flag [2] . The attackers left a note mentioning Dream Security [2] .
Citrix on Nov. 12 patched 28 vulnerabilities in NetScaler ADC and Gateway, nine of them critical memory-overflow bugs that can cause unpredictable behavior or denial of service, plus a critical flaw in NetScaler Console (CVE-2026-120869, CVSS 9.4) that could let unauthenticated attackers reach restricted resources [3] . Citrix did not say any are being exploited [3] . Fixed ADC and Gateway builds are 14.1-73.57 and 13.1-64.39 or later; Console is fixed in 14.1-74.34 [3] . Citrix also shipped fixes earlier in the week alongside Ivanti and Zoom .
Attackers began exploiting a new N-able N-central zero-day, dubbed 4EverAble2Shell, within hours of researcher Sean Bales publishing a proof-of-concept on GitHub on Nov. 12 [4] . The chain uses an Apache Axis flaw (CVE-2026-90436, CVSS 9.8) to give unauthenticated attackers root code execution on N-central servers with the Legacy API enabled, including servers on the latest 2026.4 HF2 build that N-able shipped after Bales's earlier disclosures [4] . Security firms Lupovis and Huntback saw compromises five hours after publication, with attackers installing XMRig cryptocurrency miners; Lupovis tied 21 compromised machines to the attacker's wallet [4] . No dedicated patch has been identified. N-able has restricted features including the Legacy API and said on Nov. 13 that it is working with affected customers [4] .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
