CVE-2024-1874 Command injection via array-ish $command parameter of proc_open()