It's a PHP Unserialization Vulnerability Jim, but Not as We Know It

It's a PHP Unserialization Vulnerability Jim, but Not as We Know It

Explore a comprehensive conference talk on PHP unserialization vulnerabilities, focusing on previously unidentified Remote Code Execution (RCE) exploits in widely-used open source PHP web applications and libraries. Delve into the intricacies of PHP (un)serialization, stream wrappers, and the Phar file format. Learn about basic attack methodologies, vulnerability identification techniques, and examine real-world case studies involving WordPress and TCPDF. Gain insights into defense strategies and key takeaways to enhance your understanding of these critical security issues in PHP development.