BitGo stated on October 21, 2026, that its platform was unaffected by two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS v4.0 scale. The flaws enable unauthenticated remote code execution and memory disclosure, and affect supported PHP versions dating back to PHP 5.x. The PHP Foundation released patches the same day, while affected organizations were instructed to apply them immediately or take their systems offline. BitGo attributes its immunity to long-standing relationships with security firms, proactive red-team testing and its HackerOne bug bounty program, which pays up to $20,000 for certain vulnerabilities. The company, which describes itself as a federally chartered digital asset bank and claims a zero-breach track record, also has $250 million in insurance coverage.
Source: Read the original article
