Two critical PHP flaws, nicknamed PHP2Shell, let attackers run code on web servers without logging in. Here's how they work, why AI is part of the story, and what you should do.