Hunt PHP object injection at every unserialize

Every unserialize() on external data is a candidate. The impact depends on which classes are loadable and whether any implement __destruct, __wakeup, or __toString that touch dangerous operations.

grep -rEn "unserializes*(" --include=*.php . | grep -vi 'json'
grep -rEn "function __(destruct|wakeup|toString|call)" --include=*.php .

Then look for a gadget: a magic method that reaches file writes, SQL, or eval.

class Cache { public $file; public $data;
  function __destruct(){ file_put_contents($this->file,$this->data); } } // POP sink

Pro note: phpggc catalogs known chains for common frameworks, so check the composer.lock for Laravel, Symfony, or Monolog versions with published gadgets. Also flag extract() and variable-variable includes nearby, which often accompany unsafe deserialization.