🎯 Insecure deserialization

The items that name it 8

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  article2026-10-30

  Used in PHP2Shell exploitation attempts, second in frequency after command execution.

• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  article2026-10-29

  React2Shell: React rebuilt objects from Flight payloads without checking structure, reaching child_process.execSync to run shell commands.

• I Found a $90k Remote Code Execution Vulnerability in Google
  writeup2026-10-12It is written here as Insecure deserialization: attacker-controlled pickle passed to pickle.loads in the OAuth callback, using the REDUCE opcode via __reduce__ for unauthenticated RCE.
• https://github.com/akha-security/akca
  repo2026-09-23
• CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
  advisory2026-09-14It is written here as Insecure deserialization (CWE-502).

  Exploitation path for CVE-2026-87719 using a specially crafted GraphQL subscription argument to obtain Advanced Search instance configurations and sensitive credentials, available to an authenticated user with Duo Chat access.

• Static Analysis Tools & Linters
  repo2026-08-09
• Strix
  repo2026-07-15

  Server-side vulnerability tested by Strix

• Orca: Splunk Enterprise Critical CVEs
  advisory2026-06-12

  Supplying specially crafted serialized JSON data to jsonpickle to reconstruct arbitrary Python objects and achieve remote code execution.