https://foojay.io/today/explaining-java-deserialization-vulnerabilities-part-2/