Two critical PHP vulnerabilities could let hackers execute malicious code on web servers, prompting emergency patches and urgent warnings.