PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) October 21, 2026 · Hacker News Read full story at source