PHP CVE-2026-109618 malformed PHPSESSID Set-Cookie memory disclosure

Brandon Levene@blove

•updated today•4•0•41

Detects a malformed PHPSESSID Set-Cookie header indicative of CVE-2026-109618, which may result in stale session ID memory disclosure in PHP applications.