Two critical security flaws have been found in PHP, the programming language behind a huge number of websites. The PHP project released fixes on Wednesday, urging all users to update immediately. The flaws can let an attacker run their own code on a server without logging in.