EIP-2026-109704

This exploit demonstrates a GMP deserialization type confusion vulnerability in PHP 5.6 < 5.6.30, leading to RCE in MyBB <= 1.8.3 via crafted cookie deserialization. The PoC manipulates object properties during unserialization to inject PHP code executed via eval().