I wish NCC Group had been given more time, since phpMyAdmin is nigh-ubiquitous in legacy PHP apps. For example: https://github.com/phpmyadmin/phpmyadmin/blob/

I wish NCC Group had been given more time, since phpMyAdmin is nigh-ubiquitous in legacy PHP apps. For example: https://github.com/phpmyadmin/phpmyadmin/blob/4cd8ab8a957a2324b4e218acc048642b9a6d2a23/libraries/session.inc.php https://github.com/phpmyadmin/phpmyadmin/blob/4cd8ab8a957a23... Despite setting several security-related session configuration values, they don't touch the cookie entropy fields, which means a potential session fixation vulnerability. This might not be a concern for most users: typically your distro ships a php.ini configured to read at least 16 bytes from /dev/urandom. But not always! Many projects set cookie.entropy_length and cookie.entropy_source just to be sure.