Commit 6e4082b2eba for php

commit 6e4082b2eba9d35073062dec96052272b46763ed
Author: Jorg Adam Sowa <jorg.sowa@gmail.com>
Date:   Fri Oct 16 21:55:36 2026 +0200

    ext/session: Open session files with O_CLOEXEC (#24376)

    Set close-on-exec atomically when opening the session file instead of
    issuing a separate fcntl(F_SETFD) call afterwards. This saves one
    syscall per request and closes the window in which the descriptor could
    leak into a child process forked by another thread. The fcntl() fallback
    is kept for platforms without O_CLOEXEC.

diff --git a/ext/session/mod_files.c b/ext/session/mod_files.c
index 194e9433af2..2e2d798431d 100644
--- a/ext/session/mod_files.c
+++ b/ext/session/mod_files.c
@@ -175,7 +175,11 @@ static void ps_files_open(ps_files *data, /* const */ zend_string *key)
 		data->last_key = zend_string_copy(key);

 		/* O_NOFOLLOW to prevent us from following evil symlinks */
-		data->fd = VCWD_OPEN_MODE(buf, O_CREAT | O_RDWR | O_BINARY | O_NOFOLLOW, data->filemode);
+		int flags = O_CREAT | O_RDWR | O_BINARY | O_NOFOLLOW;
+#ifdef O_CLOEXEC
+		flags |= O_CLOEXEC;
+#endif
+		data->fd = VCWD_OPEN_MODE(buf, flags, data->filemode);

 		if (data->fd != -1) {
 #ifndef PHP_WIN32
@@ -198,7 +202,7 @@ static void ps_files_open(ps_files *data, /* const */ zend_string *key)
 				ret = flock(data->fd, LOCK_EX);
 			} while (ret == -1 && errno == EINTR);

-#ifdef F_SETFD
+#if defined(F_SETFD) && !defined(O_CLOEXEC)
 # ifndef FD_CLOEXEC
 #  define FD_CLOEXEC 1
 # endif