PHP Vulnerability Responses by Company

Xero Limited

Global cloud / infrastructure
Aliases / services
Xero / Xero Limited
Official website
https://www.xero.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Xero OAuth 2.0 PHP SDK

Response status
Not listed
Response information checked
2026-10-27

The official PHP SDK documents OAuth 2.0 and Accounting API requests using tenant identifiers and access tokens.

Scope: These sources establish a customer-side PHP integration. Provider infrastructure impact or remediation for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) remains unverified. SDK availability or minimum PHP requirements are not proof of remediation.

What users should do

Rotate and store refresh tokens securely and test requests such as invoices against the intended tenant, including expired authorization handling.

Official service URL

Source URLs

  1. Xero: official PHP integration documentationhttps://github.com/XeroAPI/xero-php-oauth2Service and operation documentation
  2. Xero: official operator and legal/company informationhttps://www.xero.com/legal/terms/Service and operation documentation
Related official sources
  1. Xero: official PHP integration documentationOfficial information directory
  2. Xero: official operator and legal/company informationOfficial information directory

Comments