skills

Audit PHP engine deserialization surface (unserialize, session decoders, WDDX, phar metadata, custom ce->unserialize handlers, Serializable implementers, magic-method dispatch during deserialization) for UAF via R:/r: back-references, type confusion, partial-object __destruct, signed-length heap overflow, and parse inconsistency. Gathers zval / HashTable / var_hash semantics before launching parallel sonnet agents. Opus verifies HIGH/MEDIUM findings. For general (non-deserialization) PHP memory-safety bugs like user-callback reentrancy UAFs, use /php-audit instead.