PHP

Deserialization gadget chains have handed attackers RCE in Java and PHP apps for over a decade. This post walks through real ysoserial and PHPGGC payloads, shows exactly what the output means, and tells you what to look for in your own apps right now.