A tale of two PHP remote vulnerabilities