Zoho Says Its Products Are Unaffected by Two Critical PHP Flaws

Zoho said on October 22 that none of its products use PHP and that no customer action is needed after The PHP Foundation disclosed two critical flaws on October 21.

What happened

In its security update, Zoho describes CVE-2026-109618 and CVE-2026-109619 as remote code execution flaws in PHP web server deployments, each scored 9.2 (Critical) on CVSS v4.0 and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Zoho reviewed its products and infrastructure and reports that its products are not affected. A few blogs and public static pages ran on PHP web servers and have been updated. Gofrugal SAM uses a PHP web server and is updated. A few internal services that are not reachable from the public internet were also updated. Zoho says it found no evidence of exploitation in its environment and that “no action is required on the part of our customers.”

Why it matters

Zoho sorts its answer by surface: products, public web content, a separately named product that does run PHP, and internal services. That structure is the one a buyer’s security team uses when it asks whether a vendor’s stack is exposed to a newly disclosed flaw. For a seller, the CRM is only one line in that answer. The marketing site, separately named products and internal systems each need a status of their own.

We covered Zoho’s CRM roadmap in its Bigin Q3 update, and argued earlier that security claims need receipts.

One original insight

The notice carries a date, version numbers and a scope for each surface, which makes it easy to check. In our reading, a sales or RevOps leader should keep a one-page list of every system that touches prospect or customer data, including the website and any add-on products, so the answer to a buyer’s security email is ready the day a disclosure lands instead of the week after.

Source: Zoho Blog (Zoho security update)