Following recent reports of security vulnerabilities and incidents involving PHP, Node.js, Oracle Java, and eMudhra, we'd like to clarify their impact on our Zendesk apps.
Our Zendesk Support apps, including Lovely Views, Quickie, Escalator, Sticky Notes, and Tickler, are not affected by these security issues.
Our development team has confirmed the following:
PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Our Zendesk Support apps are built using JavaScript and run as client-side applications within Zendesk. They do not use PHP, so these vulnerabilities do not apply to them.
Node.js vulnerability (CVE-2026-111497)
While we use Node.js during development to build our apps, the apps themselves run in the browser and do not rely on Node.js servers.
As a result, this vulnerability does not affect our deployed Zendesk Support apps.
Other recent security issues
Our development team has also confirmed that our Zendesk Support apps are not affected by:
- Oracle Java vulnerabilities: Recently disclosed security vulnerabilities affecting Oracle Java.
- eMudhra Intermediate CA security incident: The reported security incident involving eMudhra's intermediate Certificate Authorities (CAs).
Do you need to take any action?
No action is required. You can continue using these apps as normal, without any updates or configuration changes related to these security issues.
Our approach to security
Security is an important part of how we develop and maintain our apps.
Our development practices incorporate industry security guidance, including the OWASP Software Assurance Maturity Model (SAMM). We also use security analysis tools to help identify potential vulnerabilities.
You can learn more about how we handle application security, data access, and third-party services in our Security Policy.
If you have any questions or concerns about the security of our apps, please contact our support team at support@lovestockleaf.com.
Comments