CVE-2016-7124

What it actually does

Mishandling of invalid objects during unserialization in ext/standard/var_unserializer.c allows crafted serialized data to trigger __destruct or other magic method calls, resulting in denial of service or further unspecified impact.

Why it matters to the business

Applications relying on PHP unserialization of untrusted data face risk of service outages and potential compromise, increasing operational costs and exposure for any systems still running unpatched versions years after disclosure.

How an attack unfolds

An attacker crafts a malicious serialized PHP object payload designed to exploit improper handling in the unserializer, then supplies it to any endpoint or input that performs unserialize on attacker-controlled data, leading to unexpected method invocations or crashes.

How to fix it

Upgrade PHP to version 5.6.25, 7.0.10 or later; for source builds apply commit 20ce2fe8e3c211a42fee05a461a5881be9a8790e. Disable unserialize on untrusted input where possible and use safe alternatives such as JSON.

How to confirm the fix worked

Confirm PHP version is at or above the fixed releases, review code for unserialize usage on external data, and test with known malicious serialized payloads to verify crashes or unexpected behavior no longer occur.

Typical attack path

1. Identify an application endpoint accepting user-controlled serialized data
2. Craft invalid object serialization that triggers magic methods or destructors
3. Transmit the payload via network request to the vulnerable unserialize call
4. Observe denial of service or attempt to escalate to additional impact

How to detect it

Review web server and application logs for unusually large or malformed serialized strings passed to unserialize functions; correlate with PHP process crashes or high CPU usage around the time of suspicious requests.

What your security team should do

• Immediately inventory all PHP deployments and prioritize upgrades to fixed versions
• Replace unserialize calls on untrusted data with safer deserialization methods
• Implement input validation and web application firewalls to block suspicious serialized payloads
• Monitor vulnerability feeds for any renewed exploit activity given the age and available public exploits