Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #php

1 post

All topics Clear tag filter

Files, objects & APIs O:4:"User":1:{s:4:"name";...}

Insecure Deserialization5 min read

PHP Object Injection: unserialize() and the Magic-Method Chain

Calling unserialize() on attacker-controlled input instantiates arbitrary classes and fires their magic methods automatically. Here is how a POP gadget chain rides __wakeup and __destruct to a dangerous sink, and why json_decode is the fix.