Ledger CTO Flags 'Really Frightening' Wave of PHP, Node.js and TLS Flaws

Charles Guillemet, chief technology officer at Ledger, used social media on October 21, 2026, to warn that a cluster of critical software and infrastructure flaws has created a security environment he described as "really frightening," with implications that extend to crypto exchange and wallet systems reliant on affected technology stacks.

At the centre of the warning are two critical vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 in severity. According to Guillemet, no patch exists for older PHP versions still running in production. The PHP Foundation is releasing a fix today, but it only covers PHP 8.2 through 8.5, leaving a substantial share of deployed infrastructure unprotected.

That gap is significant in practice. Researcher Jonathan Cran compiled data showing that 59 percent of exposed servers are still running obsolete, pre-8.1 versions of PHP, and that more than 884,000 servers worldwide carry the vulnerable code. The exposure is uneven geographically: in Argentina, 88 percent of registered equipment has no assigned patch path at all.

Node.js and TLS add to the picture

Guillemet's alert did not stop at PHP. He pointed to four high-severity flaws disclosed this month in Node.js, the widely used JavaScript runtime, which he said allow arbitrary code execution on affected systems. Separately, he flagged the compromise of eight intermediate TLS certificates, whose private keys were exposed, undermining a layer of trust that much of the web — including services handling crypto transactions — relies on to secure connections.

Taken together, the three issues span the layers that many exchange platforms, custodial wallets and web-facing crypto services depend on: the scripting language running backend logic, the runtime executing application code, and the certificate infrastructure securing data in transit. A weakness in any one of them can be enough to compromise a system that otherwise appears well defended.

Bitcoin's protocol layer unaffected

One point of reassurance in the brief concerns Bitcoin itself. The protocol's consensus layer has no dependencies on PHP and is immune to the remote-execution issues described. That distinction matters for European holders and institutions assessing where risk actually sits: the exposure lies in the surrounding web infrastructure — exchanges, wallet front-ends, custodial services — rather than in Bitcoin's core code.

For operators running crypto-facing infrastructure on older PHP builds, unpatched Node.js instances, or systems trusting the compromised TLS certificates, the practical takeaway is straightforward: patching coverage is incomplete, and the Foundation's fix released today will not reach every exposed server. Guillemet's warning functions as a prompt for operators across the sector, in Europe and beyond, to audit their stacks rather than assume the problem has already been contained.