CVE-2011-4718: Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hij...

Security readout for executives and security teams

CVE-2011-4718 is a PHP Sessions issue where older PHP versions could accept a session ID chosen by an attacker. If a victim later authenticated under that fixed session, the attacker could potentially use the same ID to hijack the web session. Exposure is most likely in web applications running PHP before 5.5.2 and using PHP's native Sessions subsystem for authenticated user state. The bundle does not identify specific downstream products, distributions, or application frameworks. Treat this as high priority for legacy PHP environments, especially internet-facing portals. The business risk is account session takeover, but urgency should be scoped to confirmed PHP versions and session usage because the bundle lacks active exploitation evidence. Mitigation focus: Upgrade PHP runtimes older than 5.5.2 to a fixed, supported release.; Follow PHP strict sessions guidance to reject uninitialized session IDs.; Review vendor or distribution guidance for backported session fixes..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.