New PHP security flaws are reported regularly, and PHP runs a very large share of the world's websites, so it is reasonable for a Zoho Sites customer to ask whether they affect Zoho Sites. This article gives Zoho's answer, explains what it does and does not tell you, and lists what customers should still check. The position is as at 22 October 2026.
The short answer
In brief: Zoho has told us, and has now said in an official statement, that it does not use PHP in its services. A vulnerability in PHP, its extensions, or PHP-based tools should therefore not apply to the Zoho Sites platform itself. That does not make a website immune to every kind of risk, and it says nothing about PHP software a customer runs elsewhere.
What Zoho said
When we asked. We asked whether the PHP security issues being reported around the world affect Zoho Sites. Zoho's answer was a plain no: it does not have PHP in its systems.
The official statement, 22 October 2026. Zoho has since published a statement on two recently disclosed PHP vulnerabilities, which it identifies as CVE-2026-109618 and CVE-2026-109619. It describes them as applying to PHP web servers and potentially leading to remote code execution. After an initial assessment, Zoho confirmed that Zoho and ManageEngine products are not affected, because PHP is not used within its services, and said no action is required from customers. It added that its assessment is ongoing, and that it will promptly notify customers of any relevant findings or changes. Our summary of the whole statement is in Zoho Statement on PHP Vulnerabilities: 22 October 2026.
What this means, and where it stops
| It means |
It does not mean |
| PHP-specific flaws, such as those in PHP itself, its extensions, or PHP-FPM, have nothing in Zoho's own stack to target. | That the platform has no vulnerabilities of any kind. Every platform runs other software that can have flaws. |
| A site built and hosted on Zoho Sites does not inherit your PHP patching burden. | That your other PHP websites are safe. A WordPress site on separate hosting is still exposed. |
| You can tell a worried customer that Zoho has said, officially, that PHP issues do not apply to its services, and that no customer action is needed. | That we have verified the claim. It is Zoho's statement, described as an initial assessment, and we have not independently audited Zoho's systems. |
Where a Zoho Sites customer can still be exposed
- Other PHP sites and tools. Many businesses run a blog, shop, or old microsite on PHP somewhere else. Those need patching whatever you use for your main site.
- Third-party content embedded in a page. A widget, form, booking tool, or script loaded from an outside service is only as secure as that service. If it runs on PHP and is compromised, the page that embeds it can be affected.
- Custom code you add. Code blocks on Zoho Sites accept HTML and scripts that run in the visitor's browser. Anything you paste in is your responsibility, so only use scripts from sources you trust.
- Accounts and access. A weak password, or an editor who has left the business, is a far more common way into a website than a software flaw.
What to check
- List every website and web application you run, and note which use PHP, including plugins and themes.
- For each PHP site, check that it runs a supported PHP version and has the latest security fixes applied, and that its hosting provider is patching the server. PHP's own advisories and your host's notices are the reliable sources, not news summaries.
- Review what is embedded in your Zoho Sites pages, and remove anything you no longer use.
- Check who has access to edit your site, remove anyone who should not, and turn on two-factor sign-in where it is offered.
- If you need formal assurance for a client or an audit, ask for Zoho's published security and compliance documentation. We can help you request it.
If a PHP site holding personal data is compromised, you may have a duty to assess the breach and, in some cases, report it to the regulator and affected people within a short deadline. This is general guidance and not legal advice, so check your own obligations.
If you are thinking of moving off a PHP site
Moving a PHP website to a platform that does not run PHP removes one class of risk and the patching work that goes with it. It is a sound reason to consider the move, but it is not a guarantee of security, and any migration needs planning so you do not lose content, search rankings, or integrations. For what the rebuilt platform offers, see The All-New Zoho Sites: AI Builder, Collections, Dynamic Pages and MCP, including what migration options exist today.
Need help? As a Zoho Partner serving the UK and Ireland, we can review your websites for exposure, plan a move to Zoho Sites, and help you request Zoho's security documentation. Email
zoho@1cloudconsultants.com or
raise a support request with 1 Cloud Consultants.