PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)