Marshalling bugs in other languages and frameworks:<p>- Java: WebSphere, WebLogic, JBoss, Jenkins : <a href="http:&#x2F;&#x2F;foxglovesecurity.com&#x2F;2015&#x2F;11&#x2F;06&#x2F;what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability&#x2F;" rel="nofollow">http:&#x2F;&#x2F;foxglovesecurity.com&#x2F;2015&#x2F;11&#x2F;06&#x2F;what-do-weblogic-webs...</a> . Admittedly most of these are through sidechannels and nothing as obvious as sessions, but it&#x27;s the same mistake.<p>- Python: <a href="https:&#x2F;&#x2F;blog.nelhage.com&#x2F;2011&#x2F;03&#x2F;exploiting-pickle&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.nelhage.com&#x2F;2011&#x2F;03&#x2F;exploiting-pickle&#x2F;</a> . Unpickling got at least Cisco Web Security Appliances: <a href="http:&#x2F;&#x2F;tools.cisco.com&#x2F;security&#x2F;center&#x2F;content&#x2F;CiscoSecurityAdvisory&#x2F;Cisco-SA-20150410-CVE-2015-0692" rel="nofollow">http:&#x2F;&#x2F;tools.cisco.com&#x2F;security&#x2F;center&#x2F;content&#x2F;CiscoSecurity...</a><p>- PHP : Of course, it&#x27;s PHP and of course, it&#x27;s WordPress . <a href="https:&#x2F;&#x2F;vagosec.org&#x2F;2013&#x2F;09&#x2F;wordpress-php-object-injection&#x2F;" rel="nofollow">https:&#x2F;&#x2F;vagosec.org&#x2F;2013&#x2F;09&#x2F;wordpress-php-object-injection&#x2F;</a><p>It&#x27;s hard to attribute malice to an obvious mistake that everyone makes.