On 22 October 2026, Zoho issued an official statement about two newly disclosed PHP vulnerabilities. This article sets out what Zoho said, what it means for customers, and what you should still check on your own systems. It is a summary of Zoho's statement, with our own comments marked as ours.
In brief: Zoho says its products, and ManageEngine's, are not affected, because PHP is not used within its services. Zoho says no action is required from customers. Zoho's assessment is still ongoing, and it says it will notify customers promptly of any relevant findings or changes.
What Zoho said
| Point |
Zoho's statement |
| The vulnerabilities | Zoho reviewed two recently disclosed PHP vulnerabilities, which it identifies as CVE-2026-109618 and CVE-2026-109619. It describes them as applying to PHP web servers and potentially leading to remote code execution (RCE) on affected systems. |
| Impact on Zoho | After an initial assessment, Zoho confirms that Zoho and ManageEngine products are not affected, because PHP is not used within its services. It says no impact on its products has been identified. |
| What customers need to do | Nothing. Zoho says no action is required on the part of its customers. |
| What happens next | The assessment is ongoing, and Zoho says it will promptly notify customers of any relevant findings or changes. |
| Zoho's wider stance | Zoho says it keeps monitoring security advisories and evaluating potential vulnerabilities to protect its services and the integrity of customer data. |
What this means for customers
This section is our own reading, not Zoho's.
- Nothing to do for your Zoho applications. If Zoho's statement is right, there is no PHP in the services you use, and no patching or configuration for you to carry out in them.
- This matches what Zoho told us earlier, when we asked whether PHP flaws affect Zoho Sites. See Is Zoho Sites Affected by PHP Vulnerabilities?.
- It is a vendor statement. We have not independently verified it, or the two vulnerability identifiers it quotes, and we have no way of auditing Zoho's systems. It is also described as an initial assessment, so it is worth watching for updates.
- It says nothing about your own systems. Zoho can speak only for Zoho's services. A website, shop, or application you run on PHP elsewhere is not covered.
What you should still check
- List every PHP system you run, including websites, content management systems such as WordPress, plugins, and any older tools that nobody has looked at for a while.
- Check each one against the vendor's advisory. Because these flaws apply to PHP web servers and could allow remote code execution, an unpatched server is the real risk. Use PHP's own advisories and your hosting provider's notices, and apply the fixed versions they name.
- Ask your hosting provider if you are not sure which PHP version your sites run on, and whether they have patched.
- Review third-party content embedded in your Zoho pages, such as widgets and scripts, since those may come from PHP-based services outside Zoho's control.
- Keep an eye on Zoho's updates, since it has said its assessment is continuing. We will update this article if it changes.
If a PHP system holding personal data is compromised, you may have a duty to assess the breach and, in some cases, report it to the regulator and affected people within a short deadline. This is general guidance and not legal advice, so check your own obligations.
Need help? As a Zoho Partner serving the UK and Ireland, we can help you identify PHP systems in your business, check their exposure, and plan a move off them where that makes sense. Email
zoho@1cloudconsultants.com or
raise a support request with 1 Cloud Consultants.
Update log
| Date |
Change |
| 22 October 2026 | First version, based on Zoho's statement of the same date. |