Two leaked PHP vulnerabilities could let attackers remotely execute code without credentials, enabling data deletion, malicious scripts and ransomware. Services including Wikipedia, Slack and Spotify, as well as the widely used WordPress platform, are at risk until a fix arrives.