In practical terms:

1. An attacker identifies a publicly accessible website running vulnerable PHP.

2. They send specially crafted HTTP requests to the website.

3. The requests trigger vulnerabilities in PHP's internal memory handling.

4. If exploitation succeeds, the attacker can execute arbitrary code on the server under the privileges of the affected PHP process.