Developers of the PHP programming language said they had identified two critical vulnerabilities, and urged users to update their sites as soon as a fix was released.