Insecure deserialization: objects that run code

January 15, 2026 · 1 min read · #web #deserialization #rce

Serializing turns an object into bytes; deserializing rebuilds it. If the bytes come from the user, you control which objects are born and with what properties.

PHP: the magic methods

unserialize($_COOKIE['data']) instantiates objects. Methods like __wakeup() and __destruct() run automatically. A POP chain strings together classes present in the codebase until one does something useful (file write, system call).

O:4:"Evil":1:{s:3:"cmd";s:2:"id";}

Defence

Do not deserialize untrusted data. Use data formats (JSON) instead of object serialization. If mandatory, sign the data (HMAC) and verify before deserializing, or use class allowlists (unserialize($s, ['allowed_classes'=>false])).

« back to home