# Trust Wallet Says Its Apps Are Unaffected by Critical PHP Flaws By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/38653 Published: 2026-10-23T03:47:16.000Z Updated: 2026-10-23T03:47:16.000Z Section: Technology > The vulnerabilities can enable unauthenticated remote code execution on vulnerable web servers; fixed PHP releases were issued Oct. 21. Trust Wallet said its wallet apps and core infrastructure are not built on PHP, telling users no action is needed after two critical flaws were disclosed that could let attackers run code on vulnerable servers. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2 out of 10. They can allow an attacker to run code remotely on a vulnerable server without authentication. The flaws affect PHP installations serving web requests, including PHP-FPM and Apache with mod_php. They concern web servers, not a blockchain protocol. Fixed PHP releases include versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The updates were issued Oct. 21 at 9:40 a.m. ET (13:40 UTC). The National Security Agency (NSA) urged organizations to inventory systems that rely on PHP and apply vendor patches. The vulnerabilities could let an attacker take control of an affected server without having an account or prior access. Earlier coverage detailed the [PHP vulnerabilities and fixes](). ## Links in this article - [PHP vulnerabilities and fixes](https://www.tokenpost.com/news/technology/37442)