The new blast radius is the management layer
The working headline is the story: Check Point exposes infrastructure alarm. In the last 72 hours, the most important security signal has not been a single product bug. It has been the repetition of a pattern across perimeter gateways, remote management software, CI pipelines, container registries and shared GPU clouds: attackers are going after the systems that operate other systems.
Check Point’s own research reconstructed intrusions that began against unpatched Security Gateways running vulnerable Mobile Access portals, then chained PHP2Shell initial access with a Gaia OS local privilege-escalation flaw tracked as CVE-2026-123039 . The attackers did not stop at the appliance. They deployed PHP web shells, installed the TSGA backdoor and TSProxy component, scanned internally, and in one investigated case pivoted to VMware ESXi over SSH before running a Linux wiper named destroy_v6 .
That matters because a gateway is not just another server. It is a trusted choke point with network visibility, routing position and administrative value. Once it becomes an attacker’s beachhead, the firewall can become a staging platform.
Check Point: from portal bug to destructive ESXi activity
Check Point said the first signs of exploitation appeared on October 30, 2026, against Mobile Access gateways, with session artifacts and repeated PHP worker crashes indicating exploitation attempts against the portal . After initial access, the attackers used CVE-2026-123039 in the DynamicCLI interface to escalate to root and place template-based PHP web shells in the portal’s login-page construction path .
The implant set is the more worrying part. TSGA, deployed as slot_CPconfigdaemon, gave the operators encrypted remote access, configuration theft, backup and snapshot persistence, process injection and firewall-log tampering capabilities . Its embedded TSProxy shared-library component supported concealed proxy access through appliance processes, meaning the intruder could hide behind legitimate gateway services rather than simply running an obvious listener .
The destructive phase shows why “edge device” is an inadequate label. Check Point reported lateral movement to a VMware ESXi host using the vpxuser service account, followed by staging and execution of the destroy_v6 wiper and the creation of DREAM_ANNEXATION.txt notes . The Hacker News separately summarized the campaign as exploitation of PHP2Shell flaws and the Gaia privilege-escalation bug to deploy TSGA and wipe ESXi files on unpatched systems .
The lesson is not only “patch Check Point.” It is that perimeter appliances often sit close enough to virtualization, identity and backup paths that a compromise can quickly become an infrastructure incident.
N-central: the RMM box is the fleet
The N-able N-central incident adds a parallel warning from the managed-services world. N-able said it was restricting some N-central features and integrations while it assessed newly disclosed flaws, including turning off Legacy API by default in hosted environments and disabling Intune integration while additional protections were implemented and validated . The company also urged hosted and on-premises customers to upgrade Agents and Probes, stressing that N-central 2026.4 HF1 changed Agent-Probe communications and that both components must be upgraded for managed devices to communicate and patch correctly .
The problem is sharper because the exploitation reports did not describe only old, neglected systems. The Hacker News reported that 21 N-central servers had been infected, including 19 running the latest Hotfix 2 . ThreatNoir reported that the 4EverAble2Shell chain worked against N-central 2026.4 HF2 build 2026.4.1.26, which had shipped on November 10, and that exploitation required the Legacy API to be enabled and reachable .
So the defensive takeaway is uncomfortable but necessary: a hotfix is not a magic state. RMM platforms need emergency patching, but also exposure reduction, feature shutdowns, credential review and compromise assessment. If an attacker lands root on the system that manages customer endpoints, the incident is no longer about one Linux server. It is about every device and customer estate reachable from that console.
CI and registries: source-to-production trust is being harvested
The same control-plane theme is visible in the wfx-loot campaign. Aikido Security said that, starting on November 10, a threat actor used stolen GitHub credentials to push a malicious workflow payload into tens of thousands of repositories . Aikido counted 4,837 compromised accounts opening probe pull requests in 61,764 repositories, and said at least 1,835 repositories ran the payload and had credentials exfiltrated .
The payload’s target was not application code for its own sake. It collected GitHub Actions secrets and variables, workflow tokens, OIDC tokens, cloud credentials, AI-provider keys, package-registry credentials, SSH material and other files commonly reachable from build runners . Aikido also described persistence moves designed to survive ordinary rotation, including AWS trust-policy changes and Azure federated identity credentials named with a wfx-ci- pattern .
That turns the CI system into a credential refinery. A stolen GitHub token opens a repository. A workflow runs. The runner exposes secrets. Those secrets unlock cloud accounts, package registries and deployments. By the time defenders see a reverted commit or a missing workflow run number, the attacker may already hold the keys to production.
Red Hat Quay shows the next stop in the chain. Red Hat rated CVE-2026-123710 critical with a CVSS score of 9.8 and described a flaw allowing an unauthenticated client to obtain an anonymous registry token, present it to the service-key rotation endpoint and install its own approved signing key with no expiry . Registry tokens signed with that key are then accepted for any repository, allowing read and write access to private images and replacement of repository tags .
Red Hat’s remediation guidance is blunt: anonymous access being disabled is not enough, because any valid Quay account can still exploit the flaw, and password resets or robot-token regeneration do not revoke an unauthorized signing key . In other words, if CI is where secrets are minted, the registry is where production artifacts are trusted. Compromise either one and deployment integrity becomes suspect.
GPU clouds: isolation is now a patching question
The final case extends the same alarm into AI infrastructure. Phoronix reported public disclosure of NvRoot, tracked as CVE-2026-47591, and ForgePtr, tracked as CVE-2026-47501, in NVIDIA Linux drivers . Phoronix described NvRoot as especially volatile for rented GPU environments because an unprivileged process in a GPU container can turn GPU behavior into host-root impact, and reported fixed NvRoot driver versions as 610.57.04, 595.91.07 and 580.178.04 .
For neocloud and multi-tenant GPU providers, this is not a narrow kernel-driver hygiene issue. GPU isolation is the product. If a tenant can cross from a rented accelerator slice to host privilege, the boundary between customers, models and expensive shared hardware becomes a promise backed only by patch velocity.
What administrators should do now
The common response is to treat management planes as tier-zero assets. Check Point gateways need verification against the PHP2Shell and CVE-2026-123039 exposure path, plus hunting for TSGA, TSProxy, zz*.tpl web shells, gogo scanner artifacts and ESXi access from gateways . N-central operators should not stop at Hotfix 2; they should disable Legacy API unless absolutely required, upgrade Agents and Probes, review feature restrictions and investigate any signs of miner deployment or root compromise .
GitHub organizations should search for wfx-docs branches, pull requests titled docs: dependency audit notes, suspicious workflow commits and missing run numbers after November 10, then rotate every secret and cloud role reachable from affected workflows . Quay operators should restrict /keys, review audit logs for suspicious key rotation or deletion with null expiration, remove unrecognized approved service keys and deploy fixed releases rather than relying on credential rotation alone . GPU providers should inventory driver branches, move to fixed NVIDIA driver versions and treat shared accelerator hosts as security boundaries that require the same urgency as hypervisors .
The infrastructure alarm is not that attackers found five unrelated weak spots. It is that every weak spot sat near a multiplier: a gateway, an RMM server, a CI runner, a registry or a shared GPU host. That is why this patch cycle feels less like routine maintenance and more like a final boss fight for the systems that run the systems.
Comments
Be the first to comment.