Check Point exploit chain used ESXi wiper; CISA sets November 16 remediation deadline

New findings concern earlier attacks, not a new November 14 outbreak

Check Point's November 12 investigation describes an October 30 attack wave against Israeli organizations that included destructive activity, followed by a November 2 wave targeting multiple countries and sectors. Investigators did not observe destruction in the second wave. The accompanying advisory identifies October 30 through November 4 as the observed exploitation period and reports approximately two dozen compromised, unpatched systems in one region. That count is not a worldwide assessment. [1][2]

The fresh policy development came on November 13, when CISA added CVE-2026-123039 to its Known Exploited Vulnerabilities catalog. The official feed sets November 16 as the remediation due date and marks forensic triage as required. Together, the investigation and listing change the defensive question from whether PHP2Shell updates were installed to whether attackers already established access. They do not establish that destructive attacks began this weekend. [1][3]

Remote entry led to root access and an internal ESXi host

The reported chain joins distinct vulnerabilities. PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, provided remote entry through vulnerable Mobile Access portals. CVE-2026-123039 then enabled local privilege escalation through Gaia's DynamicCLI service: a root-running daemon accepted commands through an inadequately protected local socket. The latter vulnerability is not, by itself, an unauthenticated remote-entry flaw. BleepingComputer's separate root-access coverage describes this additional escalation stage. [2][4]