BitGo says its platform is unaffected by critical PHP vulnerabilities

The digital asset custodian credits ongoing security testing and partnerships as patches roll out for flaws scored 9.2 in severity BitGo says its platform is safe from a pair of critical PHP vulnerabilities that sent web administrators scrambling on October 21, 2026. The flaws in question, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS v4.0 score of 9.2. The two newly disclosed vulnerabilities allow for unauthenticated remote code execution and memory disclosure. Remote code execution means an attacker can make a server run commands of their choosing from somewhere else on the internet.