Object deserialization from an untrusted source can lead to unexpected code execution. Deserialization takes a stream of bits and turns it into an object. If the stream contains the type of object you expect, all is well. But if you're deserializing data coming from untrusted input, and an attacker has inserted some other type of object, you're in trouble. Why? https://www.owasp.org/index.php/PHP_Object_Injection[A known attack scenario] involves the creation of a serialized PHP object with crafted attributes which will modify your application's behavior. This attack relies on https://php.net/manual/en/language.oop5.magic.php[PHP magic methods] like ``++__desctruct++``, ``++__wakeup++`` or ``++__string++``. The attacker doesn't necessarily need the source code of the targeted application to exploit the vulnerability, he can also rely on the presence of open-source component and use https://github.com/ambionics/phpggc[tools to craft malicious payloads].
