PHP Object Injection Check
Summary: PortSwigger's BApp Store lists a Burp Scanner extension, authored by Securify and last updated 26 August 2021, that adds an active scan check for PHP object injection vulnerabilities. The extension passes a serialized PDO object into each insertion point, and if PHP attempts to unserialize it, a fatal exception is thrown from the object's __wakeup() method in ext/pdo/pdo_dbh.c.
What's compelling: The detection method depends on a fatal exception surfacing from PHP's unserialize path, so a security team relying on this check is trusting that a crash in the target application is visible and correctly interpreted as a finding.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026