Post

🔒 FrankenPHP 1.13.4 is out: a security release fixing 7 vulnerabilities, mostly in worker mode, including a crash any client could trigger on 1.13.2 and 1.13.3. Upgrade now 👇 github.com/php/frankenp...

github.comRelease v1.13.4 · php/frankenphpFrankenPHP 1.13.4 is a security release. It fixes 7 vulnerabilities in FrankenPHP, including a high-severity one that let a single unauthenticated request crash the whole process in worker mode, an...

Kévin Dunglas

@dunglas.dev

Also in 1.13.4: Brotli 1.2.1 in Docker images and Windows builds (CVE-2026-111497), Go 1.27.3 for Windows and macOS binaries, and FrankenPHP joins @anthropic.com's OSS Scanner program. Support and consulting: @les-tilleuls.coop

Kévin Dunglas

@dunglas.dev

Apart from the header crash, introduced in 1.13.2 by a dependency change, none of these FrankenPHP vulnerabilities were exploitable in common setups, including Symfony and Laravel. They need specific app code or advanced config, like request-specific placeholders in env.

26/10/26, 7:17 pm0 reposts1 like

No replies yet.