TL;DR
- Trust Wallet said its infrastructure does not use PHP, so the recently discovered vulnerabilities do not affect its users.
- The CVE-2026-109618 and CVE-2026-109619 flaws allow attackers to execute code remotely on vulnerable servers without authentication.
- BNB Chain and PancakeSwap also ruled out direct exposure. Changpeng Zhao urged projects to disclose any potential risks.
Trust Wallet denied that the critical vulnerabilities discovered in PHP pose a direct threat to its users. The crypto wallet provider clarified that its applications and core infrastructure do not rely on the programming language.
The company issued a statement on X to address speculation about the potential consequences of the incident. According to Trust Wallet, its systems do not use PHP, meaning the identified flaws do not directly affect the wallet’s operations.
The issue emerged after the U.S. cybersecurity agency NSA Cyber warned about two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
Both flaws allow unauthenticated remote code execution on vulnerable servers, potentially giving attackers unauthorized access to affected systems.
We are aware of the recently disclosed PHP vulnerability.
Trust Wallet’s wallet apps and core infrastructure are not built on PHP. Users are unaffected and no action is required.
— Trust Wallet (@TrustWallet) October 22, 2026
Trust Wallet Rules Out Exposure to PHP Vulnerabilities
The vulnerabilities raised concerns because PHP is widely used across websites, applications, and platforms such as WordPress.
Developers released security patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to protect affected installations.
Trust Wallet explained that its infrastructure does not depend on PHP and ruled out any direct impact on its services. Its statement addressed only the exposure of its own systems and did not extend that assurance to other platforms.
BNB Chain and PancakeSwap also reported that their respective systems do not use PHP in the components under discussion, following concerns about potential risks across the crypto industry.
Changpeng Zhao Calls for Transparency to Prevent Rumors
Binance founder Changpeng Zhao (CZ) joined the discussion and recommended that projects publish information about their exposure to the vulnerabilities.
Zhao warned that a lack of information could fuel speculation among users, particularly when security flaws are discovered in widely used technologies.
Although Trust Wallet ruled out direct risks from these vulnerabilities, phishing attacks remain a threat. Criminals could exploit the security warnings to distribute fraudulent messages urging users to install supposed security updates.
The warning is particularly important for users who receive links or update instructions through unofficial channels, as Trust Wallet’s statement does not mean that every message related to the incident is legitimate.
