Description:
------------
https://github.com/php/php-src/blob/master/ext/standard/var_unserializer.c#L629

the case "C" seems to be deprecated, and none of developers/users now use it. should be removed.

"""
	case 'C':
	case 'O':	goto yy13;
	case 'N':	goto yy5;
"""

For instance, even if the programmer blocked "O"(object) on unserialize() execution, hackers can still use "C" type, which is identical to object.

Refer to https://www.owasp.org/index.php/PHP_Object_Injection for more details

Test script:
---------------
<?php

class Expl {
    public function __destruct(){
         system("id");
    }
}

echo unserialize('a:2:{i:0;s:1:"1";i:1;O:4:"Expl":1:{s:1:"a";s:1:"a";};}');
echo "is identical to";
echo unserialize('a:2:{i:0;s:1:"1";i:1;C:4:"Expl":1:{s:1:"a";s:1:"a";};}');

?>

Expected result:
----------------
uid=0(root) gid=0(root) groups=0(root)
PHP Notice:  unserialize(): Error at offset 53 of 54 bytes in /home/test/www/exploit.php on line 9
is identical toPHP Warning:  Class Expl has no unserializer in /home/test/www/exploit.php on line 11
uid=0(root) gid=0(root) groups=0(root)
PHP Notice:  unserialize(): Error at offset 37 of 54 bytes in /home/test/www/exploit.php on line 11