"Millions of devices are vulnerable": Ledger CTO

• The executive highlighted that critical vulnerabilities are already being actively exploited in the ecosystem.
• Thousands of servers with outdated versions have no technical solution and will remain exposed.

The Chief Technology Officer (CTO) of Ledger, Charles Guillemet, warned that the current state of cybersecurity is "truly frightening," due to the conjunction of critical flaws in fundamental internet infrastructures.

According to the executive, the exploitation of these gaps is already active in the digital ecosystem, compromising millions of devices worldwide that will not receive updates in the short term and anticipating that the situation will not improve soon.

Guillemet's alert, shared through his social networks on October 21, 2026, focuses on three simultaneous fronts of vulnerability.

The first corresponds to two critical flaws in the PHP programming language, rated with a severity level of 9.2 out of 10, as reported today by CriptoNoticias.

Guillemet emphasized that attempts to exploit these flaws began even before the official fix was published, reminding that there is no patch for older versions of this software.

The second risk vector falls on Node.js, where four high-severity flaws were reported this month that allow arbitrary code execution.

Finally, the CTO pointed out the discovery of eight intermediate TLS certificates whose private keys of between 3 and 8 bits were compromised. In light of this finding, Guillemet asserted that TLS standards can no longer be fully trusted.

The impact of this scenario on the bitcoin ecosystem and digital assets is direct. While the consensus of the Bitcoin protocol has no dependencies on PHP and is completely immune to these remote execution reports, the surrounding infrastructure that facilitates commercial and custody operations maintains an extensive attack surface.

The public interfaces of exchanges, internal wallet systems, decentralized finance (DeFi) platforms, and application programming interfaces (APIs) used for payments are exposed to risk.

The magnitude of the problem surrounding PHP lies in the structural dependency on legacy software. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, will be patched by The PHP Foundation today, but the update is restricted to versions 8.2 to 8.5. According to data collected by researcher Jonathan Cran, 59% of the servers exposed on the internet operate with obsolete versions --- prior to version 8.1 --- that have reached the end of their life cycle.

This leaves over 884,000 servers in a position of permanent vulnerability. The geographical distribution of this risk presents areas of extremely high exposure; in Argentina, for example, 88% of registered devices will lack an assigned patch.

The problem is exacerbated as much of this infrastructure is hosted on shared services from mass providers, allowing a single compromised address to affect hundreds of portals, historical forums, and peer-to-peer (P2P) trading scripts that use PHP simultaneously.

In light of Guillemet's confirmation of the lack of viable technical solutions for older machines, the cryptocurrency ecosystem faces a structural asymmetry. The use of automated tools assisted by artificial intelligence has drastically reduced the operational cost necessary to search for and exploit flaws on a massive scale, surpassing the response capacity of lagging infrastructures.

To mitigate this window of permanent exposure, companies and administrators who cannot immediately migrate to officially supported versions will rely on emergency containment measures. Disconnecting vulnerable endpoints, restricting access exclusively through virtual private networks (VPNs), implementing strict allowlists of permitted addresses, and constant monitoring of anomalous file generation are emerging as the main viable survival mechanisms to maintain the integrity of user funds and data.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.