How a shortcut-extension exception in yt-dlp's CVE-2024-38519 fix opened the door to CVE-2026-50023, and what the follow-up bug teaches us.