The old school phone network used in-band signaling for call setup/control. If you made long distance calls pre-90s you might remember tones after the call started connecting as an example. One of the most significant frequencies in that control setup was 2600hz (which disconnected the call in progress and left you with an open tandem trunk, giving full access to call routing functionality), made infamous by Blue Boxes, Captain Crunch, and the magazine of the same name.

2600 Hz was a frequency used as a control tone by the old telephone switches.

Basically the old telephone switches would communicate with each other by sending different frequency tones or tone pairs to execute different commands, and 2600 Hz was the tone send to indicate that a call had ended. 2600 Hz was the first of these control frequencies discovered by phone phreaks back in the day and kicked off the whole phreaking scene, and so 2600 became a shorthand for phone phreaking

More specifically, local phone lines are full electric circuits from you to whichever piece of equipment you're currently talking to (connected via relays through many other pieces that you've finished talking to). That equipment knows you're still on the phone because current is still flowing through the circuit, regardless of the audio signal.

But for long-distance, to get the most calls out of the fewest wires, they used frequency multiplexing, with no steady current flow. Instead, unused frequency carriers carried a steady 2600Hz tone, which meant the circuit wasn't connected. One end detected the lack of current flow in its local circuit and added 2600Hz; the other end detected 2600Hz and interrupted its circuit. (These frequency-division systems interfaced as local phone lines at both ends). I'm not sure how this worked bi-directionally.

So by sending a 2600Hz tone, your frequency multiplexer would still remain connected, but the other end's frequency demultiplexer would think it had disconnected. When you stop sending 2600Hz, it thinks a new connection is getting set up through the same channel (i.e. HTTP request smuggling), and interprets whatever it receives as the setup instructions for the next connection. So you send 2600 Hz, then you send the super-secret MF-tone encoding of the phone number you want it to connect you to, or you send some super-duper-secret encoding that you normally couldn't dial on your phone. Input sanitization and translation is done in the exchange your phone directly connects to, not in the core of the system, so now that you are talking to the core, you can pass it unsanitized input (i.e. server-side request forgery) - there are no buffer overflows or CSRF, but you can call things that your exchange doesn't give you a way to access, such as internal departments of the phone company that are meant to be called by operators for assistance on complex requests, various test signals, and numbers that are only meant to be dialable locally, such as the operator in that exchange.

I highly recommend checking out https://evan-doorbell.com/group-1-playlist/ which hosts podcasts of an actual past phone phreaker explaining all of this with actual recordings of the phone system from back then highlighting all the dial tones, conversations with operators, internal machinery working noises and so on.

(Networks still work this way, by the way, just with better filtering. If you could somehow get packets into the middle of your ISP's network, you could send them to all sorts of places you can't send them to from your end of the connection.)