Published: October 23, 2026
Status: Resolved
Executive summary
Zensai recently completed remediation activities related to two disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that affected certain unsupported PHP releases used within parts of our public website infrastructure.
After investigation, remediation, and validation, we found no evidence that these vulnerabilities were exploited in our environment.
The affected systems have been upgraded or patched, post-remediation validation has been completed, and the identified risk has been resolved.
Scope of impact
The affected components were limited to public-facing marketing websites and supporting web infrastructure.
The affected environment was running PHP 8.1. Zensai upgraded the affected infrastructure to supported PHP releases and applied the relevant security fixes. Validation was then completed to check for potential indicators of compromise or other security issues. No security issues were identified.
Customer assurance
Learn365, Perform365, and Engage365 don't use PHP and weren't impacted by these vulnerabilities.
The affected infrastructure was separate from the core application platforms used to deliver Zensai products and services.
As a result:
- Customer learning content wasn't impacted.
- Customer performance management data wasn't impacted.
- Customer engagement data wasn't impacted.
- Authentication and customer application services weren't impacted.
- No interruption to customer services occurred.
Findings
Our investigation found:
- No evidence of exploitation.
- No evidence of unauthorized access.
- No evidence of malicious code execution.
- No evidence of website tampering.
- No impact to customer products or services.
For any questions regarding this advisory, please contact the Zensai Security Team through the Trust Center.