CVE-2026-55590: Php Parse Url Backslash Bypasscve-2026-55590-php-parse-url-backslash-bypass
Validating local redirects by checking the 'host' key from `parse_url()` without sanitizing backslashes (`\`) is vulnerable to Open Redirect. Browsers normalize backslashes to forward slashes, meaning payloads like `/\attacker.com` will be evaluated as a relative path by `parse_url()` (leaving 'host' empty) but as an external redirect by the browser. Sanitiz
