Deserialization PHP PHP PHP serialized-object sinks, magic-method gadgets, object lifecycle behavior, and payload generation. __destruct gadget (1) __get gadget (1) __invoke gadget (1) Chaining multiple gadgets (1)