The exploit relies on a previously unknown vulnerability in the Zend Engine's opcode handling mechanism. By manipulating the opcode stream, an attacker can inject malicious code that bypasses the engine's security checks. This allows the attacker to execute arbitrary code, potentially leading to a compromise of the underlying system.