PHP Foundation rushes emergency fix for php2shell, two critical CVEs an AI helped uncover, as 1.5M hosts stay exposed.