deserialization
2 articles with this tag
Insecure deserialization — the danger is not the data, it is letting the data choose the type
The danger in deserialization is not that bad values arrive; it is that some formats let external data decide which type of object to construct. So the damage does not stop at corrupted data — OWASP lists denial of service, access control bypass and remote code execution. Two defenses: switch to a pure data format so nothing chooses types for you, and sign serialized messages so unsigned ones are never restored. And some mechanisms cannot be made safe by configuration at all; the only fix is not using them.
CVE-2026-45247 — unauthenticated RCE in a Magento extension via PHP object injection
PHP object injection (CWE-502) in Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 reaches unauthenticated RCE. CVSS 9.3. The real fix is updating to 1.11.12+. The root rule: never deserialize untrusted data.