This is a very interesting read on how Dario Weißer (@haxonaut), cutz and Ruslan Habalov (@evonide) were able to find a PHP unserialize bug to exploit and gain remote code execution on Pornhub. Pornhub’s bug bounty program is at Hackerone. In stead of actively attacking Pornhub, they took another road and attacked what Pornhub is built upon: PHP.
Read on at evonide.com: How we broke PHP, hacked Pornhub and earned $20,000.
