CoinGecko API Security Notice: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

On 21 October 2026, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We have assessed our exposure and confirm CoinGecko API (Free and Enterprise) services are not affected.

1. PHP on internet-facing systems: The CoinGecko API and the infrastructure that delivers it do not use PHP. We have also reviewed our other internet-facing systems, including https://partner.coingecko.com, https://support.coingecko.com and internal tools, and none run PHP.
2. Patching status: Not applicable. No affected systems were identified.
3. Unpatched systems offline: Not applicable.
4. Known compromise: We are not aware of any compromise related to these vulnerabilities affecting customer data or the production services you use. Our review covers activity from 17 October 2026, the earliest publicly reported exploitation date.
5. Third parties: We have reviewed published advisories from the third-party providers involved in delivering our API services to confirm their exposure and patching status. None have reported impact to CoinGecko services or customer data. We will notify you if this changes.

For questions, contact support@coingecko.com or your account team.