Patching systems impacted by the PHP vulnerabilities could take years, experts warn.