PHP Vulnerability Responses by Company

RansNet Singapore Pte Ltd

Global cloud / infrastructure
Aliases / services
RansNet / RansNet Singapore Pte Ltd / mFusion / mbox / HSG / LOG / CMG / ransnet.com
Official website
https://www.ransnet.com
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Debian 12 RansNet mFusion (cloud and on-premises)

Response status
Fixed firmware available; update required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Network management and gateway products.

RansNet instructs operators to upgrade to firmware 20261022-2200 or newer containing fixed PHP 8.2.35. Availability does not mean every installation has been updated.

Scope: Debian 12 mFusion only; older Debian 10 and gateway products are separate scopes.

What users should do

Upgrade in a maintenance window and verify the portal and managed-device connections; support customers can request remote assistance.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://docs.ransnet.com/support/notice/php-cve-2026-109618/Response evidence
  2. https://docs.ransnet.com/support/notice/https://docs.ransnet.com/support/notice/Service and operation documentation
  3. Operating entityhttps://www.ransnet.com/terms/Service and operation documentation

RansNet HSG Series (Debian 12)

Response status
Fixed firmware available; update required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Upgrade to 20261022-2200 or newer containing PHP 8.2.35. Covered models: HSG-200/400/800/1000/2000/5000.

Scope: Covered Debian 12 devices; older Debian 10 platforms require migration.

What users should do

Upgrade in a maintenance window and verify management and portal access.

Source URLs

  1. PHP2Shell response and scopehttps://docs.ransnet.com/support/notice/php-cve-2026-109618/Response evidence
  2. https://docs.ransnet.com/support/notice/https://docs.ransnet.com/support/notice/Service and operation documentation
  3. Operating entityhttps://www.ransnet.com/terms/Service and operation documentation

RansNet LOG Series (Debian 12)

Response status
Fixed firmware available; update required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Upgrade to 20261022-2200 or newer containing PHP 8.2.35. Covered models: LOG-500/1000/2000/3000.

Scope: Covered Debian 12 devices; older Debian 10 platforms require migration.

What users should do

Upgrade in a maintenance window and verify management and portal access.

Source URLs

  1. PHP2Shell response and scopehttps://docs.ransnet.com/support/notice/php-cve-2026-109618/Response evidence
  2. https://docs.ransnet.com/support/notice/https://docs.ransnet.com/support/notice/Service and operation documentation
  3. Operating entityhttps://www.ransnet.com/terms/Service and operation documentation

Legacy Debian 10 mFusion, HSG and LOG

Response status
No PHP fix; migrate to current platform
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

RansNet states the old Debian 10 platform cannot be fixed by a PHP update alone and requires interim mitigation and migration.

Scope: Older Debian 10 scope; do not treat Debian 12 firmware availability as an installed fix here.

What users should do

Restrict management access and plan migration with support; do not inadvertently block mFusion device-management connectivity.

Source URLs

  1. PHP2Shell response and scopehttps://docs.ransnet.com/support/notice/php-cve-2026-109618/Response evidence
  2. https://docs.ransnet.com/support/notice/https://docs.ransnet.com/support/notice/Service and operation documentation
  3. Operating entityhttps://www.ransnet.com/terms/Service and operation documentation

RansNet CMG Series

Response status
No web GUI; unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

RansNet lists CMG-1500, 2000, 3000 and 5000 as unaffected because they have no web GUI.

Scope: Specified CMG models; the statement does not additionally establish that no PHP is present.

What users should do

No customer update for these vulnerabilities is required.

Source URLs

  1. PHP2Shell response and scopehttps://docs.ransnet.com/support/notice/php-cve-2026-109618/Response evidence
  2. https://docs.ransnet.com/support/notice/https://docs.ransnet.com/support/notice/Service and operation documentation
  3. Operating entityhttps://www.ransnet.com/terms/Service and operation documentation

RansNet Branch Series (HSA, UA, UAP, XE)

Response status
No PHP; unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

RansNet states OpenWrt-based Branch Series does not use PHP and is unaffected.

Scope: Specified Branch models, separate from mFusion/HSG/LOG update requirements.

What users should do

No customer update for these vulnerabilities is required.

Source URLs

  1. PHP2Shell response and scopehttps://docs.ransnet.com/support/notice/php-cve-2026-109618/Response evidence
  2. https://docs.ransnet.com/support/notice/https://docs.ransnet.com/support/notice/Service and operation documentation
  3. Operating entityhttps://www.ransnet.com/terms/Service and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Operating entityOfficial information directory

Comments