Comment by stickfigure

This doesn't look like a stellar track record to me.

Year CVE Vulnerability Exploitation prerequisites

2004 CVE-2004-1019 Memory corruption in unserialize() Application processes untrusted serialized data

2006 CVE-2006-4812 Integer overflow in PHP's memory allocator through unserialize() Untrusted serialized data

2007 CVE-2007-0906 Buffer overflows in bundled PHP modules and string handling Application passes attacker-controlled data

2007 CVE-2007-1286 Integer overflow in unserialize() reference counting Untrusted serialized data

2010 CVE-2010-2225 Use-after-free in SplObjectStorage deserialization Untrusted serialized data

2012 CVE-2012-1823 PHP-CGI argument injection Vulnerable CGI deployment

2014 CVE-2014-8142 Use-after-free in PHP's unserialize() implementation Untrusted serialized data

2015 CVE-2015-0231 Use-after-free in PHP's object deserialization Untrusted serialized data

2015 CVE-2015-2787 Another use-after-free in unserialize() Untrusted serialized data

2016 CVE-2016-10160 Memory corruption in PHP's PHAR extension Application processes crafted PHAR archive

2019 CVE-2019-11043 Buffer underflow in PHP-FPM Particular web-server configuration

2024 CVE-2024-4577 PHP-CGI argument injection on Windows Particular Windows CGI configuration