title: $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
description: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
problem types: CWE-20 Improper Input Validation
affected:
{
vendor: PHP Group
product: PHP
versions:
version: 7.4.X, status: affected, lessThan: 7.4.31, versionType: custom
version: 8.0.X, status: affected, lessThan: 8.0.24, versionType: custom
version: 8.1.X, status: affected, lessThan: 8.1.11, versionType: custom
}
solutions: Upgrade to PHP 7.4.31, 8.0.24, or 8.1.11.