However, because Zend Engine 3.4.0 is used by a vast number of web applications, it remains a primary target for security researchers and malicious actors seeking to exploit core memory management or engine-level vulnerabilities. Critical Vulnerability Vectors in Zend Engine v3.4.0

The ultimate goal of the exploit, allowing an attacker to run arbitrary commands on the server.

An attacker could overwrite the zend_object handlers table, redirecting function calls (like get_class ) to system() , achieving RCE with the server's privileges.