phar 2 PHP Object Injection Leads to Arbitrary File Write | Archived Jul 27, 2026 File Extension Blacklist Bypass – Unrestricted Upload to RCE | Hackviser Lab May 4, 2026