PHP is rushing out fixes for two critical flaws, and Cloudflare says early attacks have already begun.