No public statement located for Zoho CRM as of 23 October 2026, 02:17 UTC; places checked: search:Zoho PHP2Shell; https://www.zoho.com/security.html (security page, "Last updated on: 4th December 2024", no PHP or CVE mention); https://status.zoho.com/ (302 redirect to https://us.zohostatus.com/, no dated incidents, no PHP mention); https://us.zohostatus.com/rss (status feed, latest items 15 and 16 Oct 2026, no PHP mention); https://pitstop.manageengine.com/portal/en/community/topic/security-alert-two-critical-php-rce-vulnerabilities-php2shell-rated-cvss-9-2-21-10-2026 (ManageEngine community post); https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html (fetch failed, client error).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
No public statement located as of at: search:Zoho PHP2Shell; https://www.zoho.com/security.html (security page, "Last updated on: 4th December 2024", no PHP or CVE mention); https://status.zoho.com/ (302 redirect to https://us.zohostatus.com/, no dated incidents, no PHP mention); https://us.zohostatus.com/rss (status feed, latest items 15 and 16 Oct 2026, no PHP mention); https://pitstop.manageengine.com/portal/en/community/topic/security-alert-two-critical-php-rce-vulnerabilities-php2shell-rated-cvss-9-2-21-10-2026 (ManageEngine community post); https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html (fetch failed, client error).
Notes
No Zoho statement on zoho.com or the Zoho status pages. ManageEngine (a Zoho Corporation division) community post Linux Security Alert: Two Critical PHP RCE Vulnerabilities (PHP2Shell) Rated CVSS 9.2 tells Vulnerability Manager Plus customers how to deploy PHP patches on their own Linux systems; it does not mention Zoho or Zoho CRM. The ManageEngine blog update could not be fetched in this check.
Change log
: first check
What the five engines said
AI answers not yet measured
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
A badge is issued once a public statement is located and verified on the company's own domain or verified official account.
Questions about Zoho CRM and PHP2Shell
Is Zoho CRM affected by PHP2Shell?
No public statement located for Zoho CRM as of 23 October 2026, 02:17 UTC; places checked: search:Zoho PHP2Shell; https://www.zoho.com/security.html (security page, "Last updated on: 4th December 2024", no PHP or CVE mention); https://status.zoho.com/ (302 redirect to https://us.zohostatus.com/, no dated incidents, no PHP mention); https://us.zohostatus.com/rss (status feed, latest items 15 and 16 Oct 2026, no PHP mention); https://pitstop.manageengine.com/portal/en/community/topic/security-alert-two-critical-php-rce-vulnerabilities-php2shell-rated-cvss-9-2-21-10-2026 (ManageEngine community post); https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html (fetch failed, client error).
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.