Critical PHP flaw puts 70% of websites at risk as agencies urge patches