Hunt PHP object injection at every unserialize
User-controlled input into unserialize plus a class with magic methods equals remote code execution through a POP chain.
Tag: php
Chain PHP filter wrappers to read source and reach RCE
A local file include on a PHP target can leak source via base64 and, with the iconv filter chain, generate arbitrary bytes for code execution.