Example of Insecure Deserialization

class-deserialize.php

<?php
class MyClass
{
    /**
     * @var string
     */
    protected $dontTouch;

    public function __destruct()
    {
        if ($this->dontTouch !== null) {
            throw new \Exception($this->dontTouch);
        }
    }

    public function __sleep()
    {
        return [];
    }

    public function __wakeup()
    {
        // too late
    }
}

$serialized = 'O:7:"MyClass":1:{s:12:"*dontTouch";s:6:"attack";}';
unserialize($serialized);