Security· ★★· neutral·

BitGo says its platform is unaffected by critical PHP vulnerabilities

  • —The two flaws, CVE-2026-109618 and CVE-2026-109619, are scored 9.2 on CVSS v4.0
  • —They allow unauthenticated remote code execution and memory disclosure
  • —Affected PHP versions go back to 5.x; patches shipped on October 21, 2026
  • —BitGo pays up to $20,000 via HackerOne and holds $250 million in insurance
Why it matters: Critical PHP flaws affect nearly all web-facing installations, making custodian security assurances material for institutional clients.
Source: Crypto Briefing
More on this
Security · 12:06
SlowMist flags two critical PHP vulnerabilities with CVSS 9.2
 Security · 21:28
Ledger CTO warns of critical flaws in PHP, Node.js and TLS certificates
 Security · Sep 20
Zcash developers patched critical Orchard vulnerability on June 2