Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells