Deserialization Cheat Sheet is focused on providing clear, actionable guidance for safely deserializing untrusted data in your applications. Attacks against deserializers have been found to allow denial-of-service, access control, and remote code execution (RCE) attacks. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode() ) if you need to pass serialized data to the user. override the ObjectInputStream#resolveClass() method to prevent arbitrary classes from being deserialized.”]
Source: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html