Original finding: PHP Foundation security review by Volker Metzger (@edorian)
This document: Independent validation of attack paths in Mage-OS + implementation of a fix
SymfonyAdapterProvider in Mage-OS (and identically in magento/magento2 2.4.9) deserializes cache entries from Redis and the filesystem without any integrity check. An attacker who can write to the cache backend can inject a serialized PHP object that executes arbitrary code the next time Magento reads that cache key.