After two decades of PHP, sites still expose sensitive details via debug mode