EIP-2026-104699

This PoC exploits an integer handling vulnerability in the PHP shmop module to perform an arbitrary write into process memory, specifically targeting the safe_mode global variable to bypass PHP's safe mode restrictions. The exploit uses shmop_write with a crafted offset to overwrite the safe_mode value, demonstrating privilege escalation in a shared-server environment.