BitGo says its platform is unaffected by critical PHP vulnerabilities

The digital asset custodian credits ongoing security testing and partnerships as patches roll out for flaws scored 9.2 in severity BitGo says its platform is safe from a pair of critical PHP vulnerabilities that sent web administrators scrambling on October 21, 2026. The flaws in question, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2. The two newly disclosed vulnerabilities allow for unauthenticated remote code execution and memory disclosure. Remote code execution means an attacker can make a server run commands of their choosing from somewhere else on the internet. Unauthenticated means they do not need a username or password to do it. Memory disclosure lets an attacker read data sitting in a server’s memory that was never meant to leave, which can include sensitive information.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Crypto Briefing.