PHP has two high-risk vulnerabilities with CVSS scores of 9.2, and SlowMist recommends upgrading Web3 projects immediately Odaily Planet Daily News: The SlowMist security team has released a report stating that PHP's recently disclosed CVE-226-109618 and CVE-226-109619 high-risk vulnerabilities pose a risk to the Web3 industry's off chain infrastructure. The CVSS v4.0 score for both vulnerabilities is 9.2, allowing attackers to execute arbitrary code with web service process privileges by sending construction requests to PHP services exposed on the public network without the need for account passwords or API keys. The vulnerability affects all versions of PHP 5.4 to 8.5.11, and the details of the vulnerability were leaked before the official patch was released. The Amazon threat intelligence team had observed actual exploitation attempts four days prior to the public disclosure. The MistEye scan of the SlowMist threat intelligence system shows that out of the 1488 encrypted domain names counted, 793 have direct PHP fingerprints, accounting for approximately 53.3%. The affected off chain facilities include the front-end pages, API interfaces, airdrop claim pages, operation backend, and custodial wallet services of Web3 projects. If attackers exploit PHP vulnerabilities to attack project website servers, they may tamper with front-end pages and induce users to sign malicious transactions, thereby stealing assets. The official PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released, and related projects should be upgraded to the corresponding latest versions. PHP 8.1 and earlier versions have stopped upstream regular support and should be migrated as soon as possible. Temporary mitigation measures taken when an immediate upgrade is not possible can only reduce the risk of specific attack paths, and applying patches is still a thorough solution.