Two flaws expose PHP web servers to remote attacks. Versions from the past 20 years are affected; admins should patch.