Disguise PHAR packages as images
Scary stuff.
US BlackHat 2018 proved that is possible to obtain RCE from a PHAR package, moreover, by tweaking its binary content, it's possible to disguise it as a full valid image, bypassing security checks.
Read more [www.nc-lp.com]
