Deserialization, what could go wrong?

(De)serialization allows for object portability Object -> Serialize -> Byte stream Byte stream -> Unserialize -> Object PHP Example serialize()an object to a string write string to a file unserialize()the file’s contents back into an object OWASP New Zealand Day 2016 Deserialization, what could go wrong? ................
................