Collected research

Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization

PHP :: Sec Bug #72663 :: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization

Taoguang Chen · PHP

Shows that malformed PHP serialized objects can be created with attacker-controlled properties before parsing fails and skips __wakeup(). Destructors can then run without the defensive cleanup placed in __wakeup(). Further examples retain these partially initialized objects through custom deserialization or session decoding, allowing other magic methods to be invoked.

Record

Document

PHP :: Sec Bug #72663 :: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization

Researcher

Taoguang Chen

Published by

PHP

Topic

Other

In the archive

• Collected in the 2016–17 research round

Tags

• php
• deserialization
• filter-bypass
• gadget-chain
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Taoguang Chen, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.