PHP unserialization can be triggered by other vulnerabilities previously considered low-risk.
PHP unserialization attacks have been well known for some time, but a new exploitation method explained last week at Black Hat USA in Las Vegas demonstrated that the attack surface for PHP unserialization is broader than originally thought.
“What I presented was basically a new way to start an unserialization attack,” says Sam Thomas, director of research at Secarma Ltd. “In PHP, there’s specific command called ‘unserialize,’ which starts unserialization, but actually it turns out that because of other stuff that goes into the core of PHP, there’s another other way to trigger it.”
