Untrusted user input must not be passed to igbinary_unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Instead a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) should be used, if serialized data needs to be passed to a client.

If there is the need to unserialize externally-stored serialized data, hash_hmac() can be used for data validation. It is important to ensure that nobody has tampered with the data.

The igbinary serialization format does not provide a way to distinguish between different reference groups for the same value. All PHP references to a given value as treated as part of the same reference group when unserialized, even if they were parts of difference reference groups when serialized.