CVE-2026-82416: FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP’s session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have session_id() resolve to B (a different concurrent client’s id) or to a stale id from a previous request served by the same worker thread.