A recent article on Hardened-PHP points out a couple errors in the PHP Security Consortium PHP Security Guide followed by a rant regarding the usefulness of the PHP Security Consortium in general

While the guide contains a few recommendations that are either unrealistic in shared environments or fill admins with terror, like putting database credentials into environment variables, which is obviously not a good idea with thousands of open phpinfo() scripts, there are also atleast two security bugs in their recommended practices.

The specific errors that were mentioned are in the process of being fixed, and a very complete section on using a database to store session data is promised for an upcoming release