Everything Shell Bulletin has reported about PHP object injection: 3 stories, newest first. Part of our Vulnerabilities coverage.
Disabling deserialization entirely eliminates the threat, while input validation alone fails because attackers bypass filters using encoded payloads that look harmless to basic checks.
The NVD rates CVE-2026-62076 as critical with a 9.8 score, affecting all Kalles CMS versions up to 1.1.7.1 through PHP object injection.
A critical vulnerability in WineShop allows remote attackers to inject PHP objects without authentication, risking full server compromise for unpatched stores.