CVE-2026-22200 1 Ticket to Shell - Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200) Jan 22, 2026