Unauthenticated RCE in PHP via stale global state | Hacker News Reader