Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24894 FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between r… https://www.cve.org/CVERecord?id=CVE-2026-24894
Post summary
CVE-2026-24894 reports a flaw in FrankenPHP where the $_SESSION superglobal is not reset between requests, potentially enabling session fixation attacks.
CVE-2026-24894: FrankenPHP's Zombie Sessions: When High Performance Leaks Secrets FrankenPHP, the modern application server that brings Go-like performance to PHP, suffered from a critical session isolation flaw in its worker mode. By failing to corre... https://cvereports.com/reports/CVE-2026-24894
Post summary
The post announces a critical session isolation flaw in FrankenPHP's worker mode, but does not provide PoC, exploit, active exploitation, patch, or false‑positive information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | php | frankenphp | - | - | - |