Command execution via trailing-space escaping bypass

Command injection in PHP 8.1 before 8.1.29, 8.2 before 8.2.20, and 8.3 before 8.3.8 allows remote attackers to execute commands on Windows. The proc_open() array-command path applies insufficient Windows argument escaping when the command name ends in spaces, bypassing the earlier fix and allowing shell metacharacters in attacker-controlled arguments to reach cmd.exe. Exploitation requires an application to pass untrusted argument values to proc_open() with array syntax on Windows; the injected command runs with the PHP process privileges.