BitGo has said its platform is unaffected by two critical PHP vulnerabilities disclosed on October 21, 2026, which prompted urgent action from web administrators. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2.
What the PHP flaws do
The vulnerabilities allow unauthenticated remote code execution and memory disclosure. Remote code execution enables an attacker to run commands on a server from elsewhere on the internet without needing a username or password. Memory disclosure lets an attacker read data in a server’s memory that was not meant to be exposed, potentially including sensitive information.
The flaws affect supported PHP versions going back to PHP 5.x, and nearly all PHP installations serving web requests are exposed. The PHP Foundation released patches on October 21, 2026, the same day the issues came to light. Organizations running PHP have been told to patch immediately or take affected systems offline.
BitGo’s security case
BitGo attributes its unaffected status to long-standing relationships with leading security firms, focusing on proactive vulnerability identification and red teaming. The company also runs a public bug bounty program through HackerOne, offering rewards of up to $20,000 for finding remote code execution vulnerabilities and issues directly tied to customer funds.
BitGo has established itself as a federally chartered digital asset bank. The company claims a zero-breach track record, supported by $250 million in insurance coverage.
Why custodians are held to a higher bar
Blockchain transactions generally cannot be clawed back once they settle, making the cost of a successful server compromise very different from, for example, a retailer leaking a customer email list. When a flaw scored 9.2 hits software that powers most of the web, clients of custodians want an answer quickly. BitGo provided one on the same day patches arrived.
What this means
For institutional clients, BitGo’s statement is a reminder that security posture is built long before any specific crisis. A company cannot spin up years of red team relationships and a public bounty program the morning a CVE drops. With nearly all PHP installations serving web requests exposed, any organization slow to patch remains a potential target.
