PHP has issued emergency fixes for two unauthenticated remote-code-execution flaws affecting web-serving installations. Governments and organizations took services offline while patching, but precautionary outages do not prove compromise and older PHP versions require vendor support or an upgrade.