Who've is the usual spoken form of 'who have', especially when 'have' is an auxiliary verb.