Trust Wallet Says Its Apps Are Unaffected by Critical PHP Flaws

Trust Wallet said its wallet apps and core infrastructure are not built on PHP, telling users no action is needed after two critical flaws were disclosed that could let attackers run code on vulnerable servers. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2 out of 10. They can allow an attacker to run code remotely on a vulnerable server without authentication. The flaws affect PHP installations serving web requests, including PHP-FPM and Apache with mod_php. They concern web servers, not a blockchain protocol. Fixed PHP releases include versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.