Threat video1:00
CVE-2026-123039 Check Point Gaia LPE: Detection & IOCs
PHP2Shell access on Check Point gateways chains into a Gaia LPE and an ESXi wiper. Includes 9 detection rules (one free in Splunk SPL) and 26 IOCs.
Read the full threat intel for CVE-2026-123039 Check Point Gaia LPE: Detection & IOCs →
Chapters
- 0:00The hookCISA flags two actively exploited flaws.
- 0:04The storyCheck Point's flaw grants root.
- 0:11Attack pathInitial access hit unpatched gateways.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise20 indicators to hunt: 2 IPs, 8 SHA-256 hashes and 3 file names, and more.
- 0:38MITRE ATT&CK techniques14 ATT&CK techniques, from initial access to impact.
- 0:43Remediation15 remediation steps are listed, 7 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CISA flags two actively exploited flaws.
0:05Check Point's flaw grants root.
0:07Some Israeli victims were wiped.
0:11Initial access hit unpatched gateways.
0:14Next, a missing authentication flaw gave root.
0:17Then webshells, a backdoor, and a wiper.
0:19Check Point reports active exploitation.
0:25No threat actor is attributed. Confidence: low.
0:2920 indicators to hunt: 2 IPs, 8 SHA-256 hashes and 3 file names, and more.
0:3814 ATT&CK techniques, from initial access to impact.
0:4315 remediation steps are listed, 7 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.