Blog author here. It's remote(unlike part one, where we declared variables and such) due to the fact that the exploit will work if the site takes user input and

Blog author here. It's remote(unlike part one, where we declared variables and such) due to the fact that the exploit will work if the site takes user input and unserializes it. (For instance: a certain popular adult entertainment billing system).