Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches