Internet Bug Bounty · Report #198723
Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
Validstatus
mediumseverity
4upvotes
13 Oct 2019disclosed
How it was found
The bug report at: https://bugs.php.net/bug.php?id=73367 The fix commit at: https://github.com/php/php-src/commit/0426b916df396a23e5c34514e4f2f0627efdcdf0