BitGo says its platform is unaffected by critical PHP vulnerabilities

BitGo says its platform is safe from a pair of critical PHP vulnerabilities that sent web administrators scrambling on October 21, 2026. The flaws in question, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2. What the PHP flaws actually do The two newly disclosed vulnerabilities allow for unauthenticated remote code execution and memory disclosure. Remote code execution means an attacker can make a server run commands of their choosing from somewhere else on the internet. Unauthenticated means they do not need a username or password to do it. Memory disclosure lets an attacker read data sitting in a server’s memory that was never meant to leave, which can include sensitive information. The flaws affect supported PHP versions going back to PHP 5.x, and nearly all PHP installations serving web requests are exposed. The PHP Foundation released patches on October 21, 2026, the same day the issues came to light. Organizations running PHP have been told to patch immediately or take affected systems offline. BitGo’s security case BitGo attributes its unaffected status to long-standing relationships with leading security firms. Those partnerships focus on pro...