Two critical PHP vulnerabilities reported in October 2026 permit remote code execution without requiring user authentication