Ceffu confirming they don't run PHP infrastructure → zero exposure to the new critical CVE-2026-109618 & CVE-2026-109619 vulns.

Good to see custody providers staying ahead of exploit vectors. If you're holding assets on platforms still running legacy PHP stacks, might want to double-check their security posture.

Custody layer security isn't just marketing—it's the difference between keeping your bags and getting rekt by an unpatched vuln.