Insecure Deserialization (ARCH7109)

Key php.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Decoding untrusted data with unserialize() lets an attacker inject objects and achieve remote code execution by chaining __wakeup/__destruct gadgets.

Incorrect

<?php
$data = unserialize($_COOKIE['prefs']); // gadget chain → RCE

Correct

<?php
$data = json_decode($_COOKIE['prefs'], true); // data only, no code

Fix

For untrusted data, use a structural, non-executing format such as JSON instead of unserialize; if unavoidable, pass allowed_classes => false.