EIP-2026-104754

This exploit demonstrates a code injection vulnerability in PHP's `create_function()` due to insufficient input sanitization. The PoC shows how an attacker can inject arbitrary PHP code via the `sort_by` parameter, leading to remote code execution.