---
id: 4387
title: "PHP deserialization attacks and a new gadget chain in Laravel"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/php-deserialization-attacks-and-a-new-gadget-chain-in-laravel.html"
published_at: "2024-02-12T23:00:00Z"
tags: ["php", "deserialization", "vulnerability", "pentest", "laravel", "pop-chain"]
phying_url: "https://phying.com/item/4387"
lang: en
---

# PHP deserialization attacks and a new gadget chain in Laravel

## Summary

Quarkslab explains PHP deserialization attacks and presents a new gadget (POP) chain discovered in Laravel during an engagement, along with two tricks useful for gadget hunting and a Docker lab setup.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2024-02-12T23:00:00Z
- **Original:** https://blog.quarkslab.com/php-deserialization-attacks-and-a-new-gadget-chain-in-laravel.html
- **Phying News:** https://phying.com/item/4387