BitGo confirmed that its platform remains secure following the discovery of two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, which carry a CVSS v4.0 severity score of 9.2, allow for unauthenticated remote code execution and memory disclosure.
The vulnerabilities impact PHP versions dating back to 5.x, affecting nearly all PHP installations that serve web requests. The PHP Foundation issued patches for these issues on October 21, 2026, advising organizations to update their systems immediately or take them offline.
BitGo attributes its resilience to ongoing security testing and long-term partnerships with security firms focused on red teaming. Additionally, the company maintains a public bug bounty program on HackerOne, offering rewards of up to $20 000 for identifying critical vulnerabilities.
As a federally chartered digital asset bank, BitGo reports a zero-breach track record. The company maintains $250 million in insurance coverage to protect its operations and institutional clients.
