What potential pitfalls should developers be aware of when dealing with sessions and cookies in PHP?

One potential pitfall developers should be aware of when dealing with sessions and cookies in PHP is the possibility of session fixation attacks. To mitigate this risk, developers should regenerate the session ID after a user logs in or changes privilege levels.

// Regenerate session ID to prevent session fixation attacks
session_regenerate_id(true);