Internet Bug Bounty · Report #159943
Create an Unexpected Object and Don't Invoke __wakeup() in During Deserialization
Validstatus
4upvotes
13 Oct 2019disclosed
How it was found
https://bugs.php.net/bug.php?id=72663
the first commit for fix this bug at: https://github.com/php/php-src/commit/448c9be157f4147e121f1a2a524536c75c9c6059 but this commit lead to type confusion, i reported this bug at comments. then the improve fix commit at: https://github.com/php/php-src/commit/639f7fde6a51c23d7c670358fbcb777ac1a143f3