Trust Wallet Says Its Apps Are Unaffected by Critical PHP Flaws

Trust Wallet said its wallet apps and core infrastructure are not built on PHP, telling users no action is needed after two critical flaws were disclosed that could let attackers run code on vulnerable servers.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2 out of 10. They can allow an attacker to run code remotely on a vulnerable server without authentication.

The flaws affect PHP installations serving web requests, including PHP-FPM and Apache with mod_php. They concern web servers, not a blockchain protocol.

Fixed PHP releases include versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The updates were issued Oct. 21 at 9:40 a.m. ET (13:40 UTC).

The National Security Agency (NSA) urged organizations to inventory systems that rely on PHP and apply vendor patches. The vulnerabilities could let an attacker take control of an affected server without having an account or prior access. Earlier coverage detailed the PHP vulnerabilities and fixes.