Check Point gateways compromised through PHP2Shell chain and root privileges

Check Point has confirmed that since late October, some vulnerable Mobile Access Portals have been targeted through an exploit chain associated with CVE-2026-109618 and CVE-2026-10