$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

PHP automatically converts dots in cookie names to underscores, allowing attackers to bypass security protections meant to prevent tampering with sensitive cookies. An attacker can set a regular cookie that PHP mistakenly treats as a protected one, potentially compromising security.

Attackers can exploit PHP's cookie name sanitization (dot-to-underscore conversion) to bypass `__Host-` and `__Secure-` cookie prefixes, which are designed to prevent cookie tampering. By crafting a cookie name with dots that resolves to a protected prefix after conversion, an attacker on the same network or site can inject malicious cookies that the application trusts as secure, undermining cookie integrity validation.