PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)¶
Published: 22 Oct 2026 · Severity: Critical (CVSS v4 9.2) · Status: Fixed in firmware 20261022-2200
Two critical vulnerabilities in the PHP language engine, publicly known as "PHP2Shell", were disclosed on 21 Oct 2026. They allow an unauthenticated attacker to run code on a web server that uses PHP by sending specially crafted HTTP requests. No login is required.
RansNet mFusion and the HSG and LOG Series use PHP for their web management portal, device management API and captive portal. CMG Series gateways have no web GUI, and Branch Series routers do not use PHP; neither is affected.
Summary¶
| Item | Details |
|---|---|
| CVE IDs | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical, CVSS v4 9.2 |
| Impact | Unauthenticated remote code execution on the web service |
| Affected component | PHP below 8.2.35 (and other unpatched PHP releases) |
| Fixed version | PHP 8.2.35 (8.2.35-1~deb12u1), included in firmware 20261022-2200 |
| Exploit conditions | Network access to the unit's web service (HTTP/HTTPS) |
Affected Products¶
| Product | Firmware Platform | Status | Action |
|---|---|---|---|
| mFusion (cloud and on-premise) | Debian 12 based | Affected | Upgrade to firmware 20261022-2200 |
| HSG Series (HSG-200, HSG-400, HSG-800, HSG-1000, HSG-2000, HSG-5000) | Debian 12 based | Affected | Upgrade to firmware 20261022-2200 |
| LOG Series (LOG-500, LOG-1000, LOG-2000, LOG-3000) | Debian 12 based | Affected | Upgrade to firmware 20261022-2200 |
| HSG, LOG and mFusion on older firmware | Debian 10 based | Affected, no PHP fix available | Apply the interim mitigation and upgrade to current firmware |
| CMG Series (CMG-1500, CMG-2000, CMG-3000, CMG-5000) | Debian based | Not affected (no web GUI) | None |
| Branch Series (HSA, UA, UAP, XE) | OpenWrt based | Not affected | None |
If you are unsure which platform a unit runs, contact RansNet support with the unit's model and serial number.
Older Debian 10 platform
PHP on the Debian 10 platform is past its end of life and no longer receives security fixes from its maintainers. These units cannot be fixed by a PHP update. Restrict management access now and plan an upgrade to current firmware with RansNet support.
Recommended Actions¶
Upgrade all Debian 12 based mFusion servers and HSG and LOG Series units to firmware 20261022-2200 or later. The firmware contains the fixed PHP packages and installs them automatically during the upgrade; the unit does not need Internet access to download them.
Upgrade from the CLI¶
During the upgrade the web portal, captive portal login and monitoring are briefly unavailable. Routing, VPN and firewall continue to work, and managed devices reconnect to mFusion automatically afterwards. Schedule the upgrade in a maintenance window. See the Gateway Series release notes for 20261022-2200 for the full list of changes.
Need assistance¶
Customers with a RansNet support contract can ask RansNet to perform the upgrade remotely. Contact RansNet support through the RansNet contact page. For units on the older Debian 10 platform, contact RansNet support to plan the migration to current firmware.
Priority¶
Patch first the units whose web service is reachable from untrusted networks:
- mFusion servers reachable from the Internet
- Gateways with the web management portal exposed to the Internet
- Gateways running a captive portal for guest users
- Units reachable only from internal management networks
Interim Mitigation¶
Until a unit is patched, reduce its exposure:
- Restrict the web management portal to trusted management IP addresses only. RansNet support can apply this restriction for you; it keeps device management and monitoring working.
- Keep the device management interface open on mFusion. Managed routers need it to report status and receive configuration; restricting it disconnects managed devices.
- Disable unused web services, such as a captive portal that is no longer in use.
These steps reduce exposure but do not remove the vulnerability. Apply the patch as soon as possible.
Verification¶
| Items to Test | Command | Expected Outcome |
|---|---|---|
| Firmware version | show version |
20261022-2200 or later |
| PHP version | php -v (shell) |
PHP 8.2.35 or later |
| Web management portal | Log in to the GUI | Dashboard loads normally |
| Managed devices (mFusion) | Device list in the GUI, after 5–10 minutes | Devices remain UP |
Security Best Practices¶
- Never expose the management portal to the whole Internet. Allow it only from management networks or through a VPN.
- Keep firmware current. Units on current firmware receive platform security updates; units on end-of-life platforms do not.
- Review this notice page regularly. New advisories are published under Security Notice.
References¶
- Debian security tracker: CVE-2026-109618
- Debian security tracker: CVE-2026-109619
- Rapid7: Critical Unauthenticated RCE in PHP
- Unit 42: Threat Brief
Revision History¶
| Date | Change |
|---|---|
| 22 Oct 2026 | Initial publication |