Fireblocks is not affected by the PHP2Shell vulnerabilities or the eMudhra (emSign) certificate incident, and your assets remain protected.
Two industry-wide security issues were disclosed on October 20 and October 21. PHP2Shell, with Common Vulnerabilities and Exposures (CVE) IDs CVE-2026-109618 and CVE-2026-109619, is a set of critical flaws in the core PHP engine that can allow remote code execution without authentication. The eMudhra (emSign) incident is the compromise of eight intermediate certificate authority (CA) certificates. The private keys for these certificates were generated with weak randomness, so anyone could use them to forge trusted TLS certificates.
Fireblocks assessed both as soon as they were disclosed, and we can assure you that the platform and your assets remain protected.
PHP2Shell vulnerabilities
The Fireblocks platform (key management, Multi-Party Computation (MPC) signing, Policy enforcement, the Console and the API) and overall cloud runtime environment do not run on PHP and are not exposed to these vulnerabilities.
eMudhra certificates
Fireblocks services were not affected by this incident. As an added precaution, we are hardening the platform by updating our base images and every application that maintains its own trust store. We have also removed the affected eMudhra certificates from the relevant flows, and we are reviewing our corporate environment to remove any remaining use of them.