Lab: Using PHAR deserialization to deploy a custom gadget chain | Insecure deserialization