{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/frankenphp--1.12.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dunglas:frankenphp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-82416"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FrankenPHP (\u003c= 1.12.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","session-management","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Dunglas"],"content_html":"\u003cp\u003eFrankenPHP is susceptible to a cross-user session ID leakage vulnerability when operating in worker mode. The root cause is a build-time configuration discrepancy: the internal logic designed to clear session identifiers (\u003ccode\u003ePS(id)\u003c/code\u003e) between requests is wrapped in a preprocessor macro \u003ccode\u003e#ifdef HAVE_PHP_SESSION\u003c/code\u003e. This macro is only defined if the PHP session extension is statically linked at the time FrankenPHP is compiled.\u003c/p\u003e\n\u003cp\u003eWhen FrankenPHP is deployed using packages that utilize a shared PHP session extension (common in many Linux distribution repositories), the cleanup function is excluded from the binary. Consequently, worker threads retain the session state from the previous request. If a subsequent request arrives, the \u003ccode\u003esession_start()\u003c/code\u003e function may reuse the stale session identifier instead of parsing the cookie provided by the current client. This results in session hijacking or cross-user data exposure, impacting any FrankenPHP worker mode deployment relying on shared-module PHP builds (v1.12.4 and earlier).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target server running FrankenPHP in worker mode with a shared \u003ccode\u003esession\u003c/code\u003e extension.\u003c/li\u003e\n\u003cli\u003eAttacker maintains an active session (Session A) and observes that the application uses cookie-based session tracking.\u003c/li\u003e\n\u003cli\u003eAttacker sends a high volume of concurrent requests to the target, alternating between their Session A and a second controlled Session B.\u003c/li\u003e\n\u003cli\u003eThe FrankenPHP worker thread serves Request 1 for User A, leaving the session ID in \u003ccode\u003ePS(id)\u003c/code\u003e memory space.\u003c/li\u003e\n\u003cli\u003eThe same worker thread processes Request 2 for User B. Because the session state was not reset, the application fails to re-read the provided cookie and instead defaults to the lingering ID from User A.\u003c/li\u003e\n\u003cli\u003eThe server returns a response to User B that includes data or state associated with User A, confirming the cross-user leak.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in critical session exposure, where a user may be assigned an arbitrary, foreign session ID, leading to account takeover or unauthorized access to other users' data. This behavior is persistent under load in multi-worker environments. Deployment on standard Linux package manager distributions (RPM/Debian) that ship PHP as shared modules is highly likely to be affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a FrankenPHP build where the \u003ccode\u003esession\u003c/code\u003e extension is statically linked, such as the official static binaries or Docker images.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement an application-level workaround by calling \u003ccode\u003esession_id('')\u003c/code\u003e immediately after \u003ccode\u003esession_write_close()\u003c/code\u003e in the worker loop to force a re-read of session cookies on the next request.\u003c/li\u003e\n\u003cli\u003eAudit current environment deployment configurations to determine if the \u003ccode\u003esession\u003c/code\u003e extension is loaded as a shared module via \u003ccode\u003econf.d\u003c/code\u003e or statically compiled into the PHP-ZTS binary.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:24:45Z","date_published":"2026-10-15T22:24:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frankenphp-session-leak/","summary":"A build-time dependency issue in FrankenPHP causes cross-user session ID leakage when the PHP session extension is loaded as a shared module in worker mode.","title":"FrankenPHP Cross-Request Session ID Leak in Worker Mode","url":"https://feed.craftedsignal.io/briefs/2026-10-frankenphp-session-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - FrankenPHP (\u003c= 1.12.4)","version":"https://jsonfeed.org/version/1.1"}