BitGo says its platform is safe from a pair of critical PHP vulnerabilities that sent web administrators scrambling on October 21, 2026.
The flaws in question, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2.
What the PHP flaws actually do
The two newly disclosed vulnerabilities allow for unauthenticated remote code execution and memory disclosure.
Remote code execution means an attacker can make a server run commands of their choosing from somewhere else on the internet. Unauthenticated means they do not need a username or password to do it.
Memory disclosure lets an attacker read data sitting in a server’s memory that was never meant to leave, which can include sensitive information.
The flaws affect supported PHP versions going back to PHP 5.x, and nearly all PHP installations serving web requests are exposed.
The PHP Foundation released patches on October 21, 2026, the same day the issues came to light. Organizations running PHP have been told to patch immediately or take affected systems offline.
BitGo’s security case
BitGo attributes its unaffected status to long-standing relationships with leading security firms. Those partnerships focus on proactive vulnerability identification and red teaming.
The company also runs a public bug bounty program through HackerOne. It offers rewards of up to $20,000 for finding remote code execution vulnerabilities and issues directly tied to customer funds.
BitGo has also established itself as a federally chartered digital asset bank. The company claims a zero-breach track record, supported by $250 million in insurance coverage.
Why custodians are held to a higher bar
Blockchain transactions generally cannot be clawed back once they settle. That makes the cost of a successful server compromise very different from, say, a retailer leaking a customer email list.
So when a flaw scored 9.2 hits software that powers most of the web, clients of custodians want an answer fast. BitGo provided one on the same day patches arrived.
What this means
For institutional clients, BitGo’s statement is a reminder that security posture is built long before any specific crisis. A company cannot spin up years of red team relationships and a public bounty program the morning a CVE drops.
With nearly all PHP installations serving web requests exposed, any organization slow to patch remains a potential target.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.