Trust Center Updates
Zylo's impact regarding eMudhra CA compromise
On October 17, 2026, security researchers reported that private keys for eight eMudhra intermediate certificate authorities had been compromised. Zylo has reviewed every customer-facing endpoint and confirmed none have ever chained to any certificate authority involved in this incident. Zylo continues to update certificate trust stores across its internal systems as vendors release fixes, and has found no evidence that any Zylo system or customer data was affected. Questions? Contact Zylo Support or email security@zylo.com.
Zylo's impact regarding recently disclosed PHP vulnerabilities
On October 20th, 2026, information regarding two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) was publish. Zylo does not utilize PHP within its product, back-end systems/services or by way of its subprocessors. As a result, customer environments within Zylo's platform are not affected and Zylo has not been impacted. Questions? Contact Zylo Support or email security@zylo.com
What Zylo does
Zylo, Inc. (Zylo) provides a software management platform to help customers gain full visibility into their cloud-based software and proactively manage applications, forecast spending, mitigate risks, and track renewal agreements. To achieve this goal, Zylo has established a framework that defines how customers establish software-as-a-service (SaaS) governance, enabling customers to discover software applications by uncovering full visibility of software spending across the organization, manage software renewals by proactively managing subscriptions with more data and leverage, measure software utilization by measuring the actual usage and value of software applications, and secure sensitive data by tracking which third-party applications store personally identifiable information (PII) or other sensitive data.
Reporting Security Bugs
Zylo doesn't currently run a formal bug bounty program, but we take security seriously and welcome responsible disclosure from the research community. If you've found a vulnerability with realized risk rated High or Critical, and can include clear reproduction steps, report it to [security@zylo.com]. We review every submission in good faith — substantial findings, handled professionally and in good faith, may be considered for compensation on a case-by-case basis.
