Two critical vulnerabilities in PHP are facing active exploitation attempts, creating an urgent need for widespread patching, according to cybersecurity researchers.