Benji Fisher
--- a/core/modules/migrate/src/Plugin/Discovery/AnnotatedClassDiscoveryAutomatedProviders.php
+++ b/core/modules/migrate/src/Plugin/Discovery/AnnotatedClassDiscoveryAutomatedProviders.php
                if (isset($cached['id'])) {
                  // Explicitly unserialize this to create a new object
                  // instance.
-                  $definitions[$cached['id']] = unserialize($cached['content']);
+                  $definitions[$cached['id']] = unserialize($cached['content'], ['allowed_classes' => FALSE]);
--- a/core/modules/migrate_drupal/src/Plugin/migrate/source/DrupalSqlBase.php
+++ b/core/modules/migrate_drupal/src/Plugin/migrate/source/DrupalSqlBase.php
    catch (\Exception) {
      $result = FALSE;
    }
-    return $result !== FALSE ? unserialize($result) : $default;
+    return $result !== FALSE ? unserialize($result, ['allowed_classes' => ['stdClass']]) : $default;