For Laravel apps the framework's own session layer doesn't use PHP's native sessions, so the serialize_handler case Nils describes should be rare right? Still worth switching off until the patch is out.
Small PHP security followup, worth checking out
commit 796cb85