CoinGecko incident
CoinGecko API Security Notice: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Ongoing since 06:05 AM UTC, affecting CoinGecko Pro API and CoinGecko Public API and 1 more.
On 21 October 2026, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We have assessed our exposure and confirm CoinGecko API (Free and Enterprise) services are not affected. PHP on internet-facing systems: The CoinGecko API and the infrastructure that delivers it do not use PHP. We have also reviewed our other internet-facing systems, including https://partner.coingecko.com, https://support.coingecko.com and internal tools, and none run PHP. Patching status: Not applicable. No affected systems were identified. Unpatched systems offline: Not applicable. Known compromise: We are not aware of any compromise related to these vulnerabilities affecting customer data or the production services you use. Our review covers activity from 17 October 2026, the earliest publicly reported exploitation date. Third parties: We have reviewed published advisories from the third-party providers involved in delivering our API services to confirm their exposure and patching status. None have reported impact to CoinGecko services or customer data. We will notify you if this changes. For questions, contact [email protected] or your account team.
Affected components
Update timeline
- investigating Oct 22, 2026, 06:05 AM UTC
On 21 October 2026, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We have assessed our exposure and confirm CoinGecko API (Free and Enterprise) services are not affected. PHP on internet-facing systems: The CoinGecko API and the infrastructure that delivers it do not use PHP. We have also reviewed our other internet-facing systems, including https://partner.coingecko.com, https://support.coingecko.com and internal tools, and none run PHP. Patching status: Not applicable. No affected systems were identified. Unpatched systems offline: Not applicable. Known compromise: We are not aware of any compromise related to these vulnerabilities affecting customer data or the production services you use. Our review covers activity from 17 October 2026, the earliest publicly reported exploitation date. Third parties: We have reviewed published advisories from the third-party providers involved in delivering our API services to confirm their exposure and patching status. None have reported impact to CoinGecko services or customer data. We will notify you if this changes. For questions, contact [email protected] or your account team.
Your product runs on more than CoinGecko
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services