CVE-2007-3799: The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attacker...

Security readout for executives and security teams

This is an old PHP session handling flaw. A remote attacker could influence how PHP generated a session cookie and inject extra cookie attributes using special characters. The business concern is mainly legacy exposure: systems still running PHP 4.x through 4.4.7 or PHP 5.x through 5.2.3 may mishandle session cookies. Exposure is most likely in unsupported legacy PHP deployments, old packaged distributions, embedded products, or appliances that bundled affected PHP versions. Modern PHP versions should not be assumed affected from this bundle. Prioritize if any business system still runs legacy PHP or vendor appliances from the affected era. For fully modern PHP estates, treat as an inventory confirmation item rather than an emergency. Mitigation focus: Inventory internet-facing and internal systems running legacy PHP 4.x or early PHP 5.x.; Apply the relevant vendor or distribution advisory for affected packaged PHP builds.; Upgrade unsupported PHP runtimes beyond the affected version ranges..

Prepared

Jun 29, 2026, 04:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.