Also just to reply to RagingCactus's sibling comment which was somehow downvoted to death (HN users, never change.) for quoting the Wiz post, the two PHP vulnerabilities alone are still not to bypass ASLR.

CVE-2026-109619 is the main memory related vulnerability but it alone isn't enough to break OS level ASLR unless you spam it (brute forcing).