[HIGH] OpenMage LTS: Phar Deserialization leads to Remote Code Execution

PKSA-w28m-jx16-bpbn CVE-2026-25524 GHSA-fg79-cr9c-7369

Affected package: openmage/magento-lts

Affected version: <20.17.0

Reported by:
GitHub