Session Management Flaw in FrankenPHP Affects Multiple Versions

CVE-2026-24894

What is CVE-2026-24894?

FrankenPHP, a modern application server for PHP, has a session management flaw that allows the $_SESSION superglobal to retain data from previous requests while running in worker mode. This issue occurs before the session_start() function is invoked, leading to potential data exposure from one request to another, possibly compromising user privacy. The vulnerability has been addressed in version 1.11.2, urging users to update their installations for enhanced security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References