Two critical PHP vulnerabilities that could allow hackers to remotely execute code on servers without authentication have triggered a cybersecurity alert, potentially exposing millions of internet-facing services. In a separate advisory, PHP also urged users to temporarily disable a file-upload tracking feature to mitigate another remote code execution risk, adding to concerns over the widely used programming language.