PHP maintainers knew of critical flaw for two years, report says