Mior and Skyfall Attacks Expose AMD SEV-SNP VMs Allowing Rogue Hosts to Steal Secrets and Modify Memory

Check Point Security Gateways Compromised via PHP2Shell Exploits to Deploy VMware ESXi Data Wiper

Vulnerable Check Point Security Gateway instances were targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. The campaign began on October 30 against Israeli organizations and later expanded to multiple countries. Attackers exploited two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 for unauthenticated remote code execution, then chained them with a zero-day tracked as CVE-2026-123039 for root access. They installed PHP webshells and the TSGA backdoor with TSProxy networking component before moving laterally to ESXi hosts using the gogo scanner. In the final stage, the destroy_v6 wiper was deployed to recursively delete data with optional zero-fill overwriting. Political messages referencing Dream Security Ltd. were left on some systems, raising false-flag concerns. Check Point linked elements to the PhiliKit framework associated with UNC5221 but could not confirm attribution.

Microsoft November 2026 Security Updates Break Printing for Complex Documents

Microsoft has warned that its November 2026 security updates are causing printing failures on both server and client Windows systems. The issue occurs when documents contain images rendered with a height or width value of zero at the selected printing resolution. These zero-dimension images are commonly used for invisible watermarks, layout anchoring, or by generation tools that insert placeholder graphics. The problem primarily affects Microsoft Word documents printed through the Windows Graphics Device Interface but can impact other applications as well. Microsoft stated it is investigating the regression and will release additional guidance when available. This marks the latest in a series of printing-related problems introduced by recent cumulative updates, including issues from March and July 2025 as well as August 2026 .NET Framework patches.

Check Point Releases Emergency Hotfixes for Zero-Day CVE-2026-123039 Exploited for Root Access

Check Point has issued emergency hotfixes to address a high-severity local privilege escalation vulnerability tracked as CVE-2026-123039. The flaw resides in the DynamicCLI IPC interface of Gaia OS and has been actively exploited since late October to obtain root privileges and maintain persistence on affected devices. Attackers first compromised the Mobile Access portal via the PHP2Shell vulnerability before chaining it with CVE-2026-123039 to escalate privileges. They then deployed webshells, the TSGA backdoor, and TSProxy malware previously linked to Ivanti appliance attacks, pivoted to VMware ESXi hosts, and installed destructive wiper malware. Check Point observed the exploit targeting several dozen customers across its Firewall, Security Gateway, and Security Management Server products. Temporary mitigation involves stopping the dynamic_server process, while indicators of compromise include unusual system() sink usage and non-Clish commands. This marks the third zero-day campaign against Check Point products in recent months, following earlier exploitation of CVE-2026-93616 and CVE-2026-85102.