PHP has released emergency patches for two critical vulnerabilities that could enable unauthenticated remote code execution. Security researchers report attempted exploitation, while authorities urge immediate updates across internet-facing hosting environments.