PHP, which is used in most major operating systems, has issued fixes for two critical vulnerabilities. Security leaders discuss.