Zoho CRM and PHP2Shell

The statement

No public statement located as of 23 October 2026, 02:17 UTC at: search:Zoho PHP2Shell; https://www.zoho.com/security.html (security page, "Last updated on: 4th December 2024", no PHP or CVE mention); https://status.zoho.com/ (302 redirect to https://us.zohostatus.com/, no dated incidents, no PHP mention); https://us.zohostatus.com/rss (status feed, latest items 15 and 16 Oct 2026, no PHP mention); https://pitstop.manageengine.com/portal/en/community/topic/security-alert-two-critical-php-rce-vulnerabilities-php2shell-rated-cvss-9-2-21-10-2026 (ManageEngine community post); https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html (fetch failed, client error).

Notes

No Zoho statement on zoho.com or the Zoho status pages. ManageEngine (a Zoho Corporation division) community post Linux Security Alert: Two Critical PHP RCE Vulnerabilities (PHP2Shell) Rated CVSS 9.2 tells Vulnerability Manager Plus customers how to deploy PHP patches on their own Linux systems; it does not mention Zoho or Zoho CRM. The ManageEngine blog update could not be fetched in this check.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

Zoho CRM's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Zoho CRM and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.