On October 20, 2026, critical security vulnerabilities were disclosed in PHP (CVE-2026-109618 and CVE-2026-109619) that could allow remote code execution. Showpad products were assessed as soon as the PHP security advisory was published and a fix was applied promptly after release to relevant products utilizing PHP.
Because aspects of the Showpad platform use PHP, Showpad’s threat intelligence alerted our Security Operations (SecOps) team who immediately began assessing the potential impact and coordination of remediation.
Prior to official patch release, Showpad conducted the following steps to protect the Showpad platform:
- Reviewed and continuously monitored our logs for signs of targeting
- Identified scanning activity and blocked it with our Web Application Firewall (WAF)
Once the fixes were released, the Showpad engineering team patched the products listed as remediated below:
| Product | Status | Date Patched |
| Showpad | Remediated | 21 October 2026 |
| Zunos | Remediated | 21 October 2026 |
| Bigtincan Content Hub | Remediated | 22 October 2026 |
| Modus | Remediated | 22 October 2026 |
| SalesDirector.ai | Remediated | 22 October 2026 |
| ClearSlide | Remediated | 22 October 2026 |
| Brainshark | Not impacted | Not applicable |
| VoiceVibes | Not impacted | Not applicable |
| Scorecards | Not impacted | Not applicable |
| FatStax | Not impacted | Not applicable |
| imSMART | Not impacted | Not applicable |
| XINN | Not impacted | Not applicable |
| Scrollmotion | Not impacted | Not applicable |
Remediated: the patch was applied on the date shown. Not impacted: we assessed these products and confirmed that they do not use the affected PHP components, so no action is needed.
If you have further questions, please contact your Showpad Account Team or security@showpad.com.
