Session deserialization RCE via serialize_handler mismatch (no LFI)

Exploits the interaction between php_serialize and php session handlers:
when one endpoint writes sessions with php_serialize (Laravel, Symfony
default) and another reads with the php handler (PHP default), injected
pipe characters cause arbitrary deserialization at session_start().

12 built-in POP chains covering current and legacy library versions:
- monolog3-fw: Monolog 3.0+ (tested 3.12.1, latest)
- laravel10-cmd/fw: illuminate 10.0-13.x+ (tested v13.38.0, latest)
- monolog-cmd/fw: Monolog 1.17.2-2.x
- laravel-cmd/fw: illuminate 5.4-8.x
- guzzle-fw: Guzzle 4.0-7.x
- symfony-cmd/fw: Symfony 2.6-4.4.18
- wordpress-cmd/fw: WordPress 6.4.0-6.4.1

All chains tested end-to-end through the full HTTP exploit flow on
PHP 8.3. Accepts custom phpggc chains via --chain-file.

session-deser/test_trigger.php

@@ -0,0 +1,18 @@
+<?php
+/**
+ * Test endpoint: default php handler.
+ * Just calls session_start(). The handler mismatch causes
+ * deserialization of objects injected via the php_serialize endpoint.
+ *
+ * In the wild, this maps to any PHP script on the same host that:
+ *   - Does NOT set session.serialize_handler to php_serialize
+ *   - Calls session_start()
+ *   (phpMyAdmin, legacy scripts, admin panels, etc.)
+ *
+ * Autoloads Monolog so deserialized objects have real classes.
+ */
+require __DIR__ . '/vendor/autoload.php';
+
+session_start();
+
+echo "OK pid=" . getmypid();