Kévin Dunglas

Kévin Dunglas

@dunglas.dev

⚒️ FrankenPHP.dev, Mercure.rocks, @api-platform.com, @symfony.com 🧑‍💻 Founder of @les-tilleuls.coop, a developer co-op

1.7K followers146 following338 posts

Kévin Dunglas
@dunglas.dev

Apart from the header crash, introduced in 1.13.2 by a dependency change, none of these FrankenPHP vulnerabilities were exploitable in common setups, including Symfony and Laravel. They need specific app code or advanced config, like request-specific placeholders in env.

Kévin Dunglas
@dunglas.dev

🐳 Docker: Refreshed! 1.13.1 (PHP 8.5.12) and all 1.13.2 images (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12) are ready. ⚙️ Binaries: Static binaries published with patched PHP 8.5.12. A big thanks to Alex Dubois, Marc Henderkes, the PHP Foundation and everyone involved!

github.comRelease v1.13.2 · php/frankenphpFrankenPHP 1.13.2 is a security release. Its Docker images and static binaries are built with the PHP versions that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical vulnerabilities...
Kévin Dunglas
@dunglas.dev

🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours 🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready

Kévin Dunglas
@dunglas.dev

💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!

Kévin Dunglas
@dunglas.dev

Like most capitalist products, commercial LLMs are an ecological, social, and economic aberration in how they're built and deployed.

Kévin Dunglas
@dunglas.dev

We must fix this by building democratically controlled public AI services, rationing water and power, fairly compensating workers extracting raw materials needed for hardware and training-data creators, and banning harmful or useless use cases.

Kévin Dunglas
@dunglas.dev

We need this alternative all the more because I fully agree with Linus Torvalds: these tools are impressive, and refusing them outright is unprofessional. Weeks of senior dev labor can no longer match what AI uncovers in minutes regarding security flaws, bugs, and performance optimization!

Kévin Dunglas
@dunglas.dev

Fighting planned obsolescence with AI 🌻

Tilia.coop@tilia.coop

Learn with @soyuka.me how his team used AI agents and a €15 adapter to reverse-engineer a 15-year-old heating controller, recover its missing source code, and bring their legacy office infrastructure directly into Home Assistant. Read the full story here tilia.coop/home-assista...

Kévin Dunglas reposted

Les-Tilleuls.coop
@les-tilleuls.coop

Le nouveau site de la Caisse de Solidarité est en ligne, et notre équipe s'est chargée des évolutions 👏 Cette sortie tombe à pic avec les mouvements actuels, ce qui nous permet de rappeler notre soutien aux lycéen·es dans la rue pour défendre leurs droits : caisse-solidarite.fr

caisse-solidarite.frCaisse de solidarité — 8 553 611 € collectés depuis 2016Depuis 2016, la Caisse de solidarité a collecté 8 553 611 € pour soutenir les salariés en lutte.

Kévin Dunglas reposted

onestla.tech
@onestla.tech

🎭 Masque : l'app sécurisée pour flouter automatiquement les visages sur vos photos et vidéos de manif et d'évènements ⚙️ Traitement 100 % local 🔒 Libre et auditable 🤝 Une collab l'Offensive / onestla.tech 📲 masque.onestla.tech

Kévin Dunglas reposted

Les-Tilleuls.coop
@les-tilleuls.coop

Depuis plus de 15 ans, nous concevons des architectures robustes et open source. Aujourd'hui, nous lançons @tilia.coop, notre nouvelle structure dédiée à l'IA sur mesure ! Découvrez notre démarche sur notre blog, et suivez Tilia sur les réseaux ! les-tilleuls.coop/blog/decouvr...

les-tilleuls.coopLes-Tilleuls.coop annonce le lancement de Tilia, son offre d’accompagnement sur mesure en intelligence artificielle | Les-Tilleuls.coopDécouvrez Tilia, propulsée par Les-Tilleuls.coop. Profitez de 15 ans d'expertise web pour intégrer l'IA sur mesure dans vos outils.
Kévin Dunglas
@dunglas.dev

🐘 FrankenPHP 1.13 is out! Caddy 2.11.7 (Slowloris protection, url_pattern matcher, RFC 10036 Incremental header), Mercure 1.0 built in, and config reloads validated before they go live. 5 security fixes, 2 rated high. Please upgrade.

Kévin Dunglas
@dunglas.dev

Ticketing closes this weekend: if you haven't grabbed your seat yet, this is your last chance (tickets are free for students and job-seeking devs). We also have major ecosystem announcements lined up for the keynotes... stay tuned!

Kévin Dunglas reposted

AFUP
@afup.org

Pour démarrer la semaine, lisez l'interview de @dunglas.dev : il nous parle notamment de la genèse mouvementée de FrankenPHP et tease Mercure 1.0, fruit de 5 ans de travail, qui sera sorti à l'heure où Kévin donnera son talk et animera son atelier au Forum PHP 2026 ! buff.ly/26Zgz6w

Kévin Dunglas
@dunglas.dev

🚀 Mercure 1.0 alpha is here! The biggest release in the project’s history brings: 🎯 New matcher system built on top of the WHATWG URL Pattern ⚙️ Revamped authorization mechanism using OAuth 2.0 Rich Authorization Requests 🛠️ Brand-new UI debugger and dev playground 🔒 Security hardening

dunglas.devMercure 1.0 alpha is here - Kévin DunglasMercure 1.0 is here in its first public preview, and it is the biggest release in the project's history! Mercure powers mission-critical real-time communication across hundreds of production deploymen...
Kévin Dunglas
@dunglas.dev

Tried GitHub's new syntactic sugar for parallel action steps on FrankenPHP's CI. Gains were minimal for our use case, and it currently breaks actionlint (unsupported parallel keyword). Shelved for now: github.com/php/frankenp...

github.comci: run independent steps in parallel by dunglas · Pull Request #2597 · php/frankenphpGitHub Actions added native parallel steps: https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/ Grouped independent steps that were previously run sequentially for no...
Kévin Dunglas
@dunglas.dev

FrankenPHP 1.12.7 fixes a bug where output written after fastcgi_finish_request() got silently dropped in classic mode, and killed the rest of the script execution right there. If you use that pattern for background cleanup, go upgrade. github.com/php/frankenp...

github.comRelease v1.12.7 · php/frankenphpFrankenPHP 1.12.7 fixes a bug where output written after fastcgi_finish_request()/frankenphp_finish_request() was silently discarded in classic (non-worker) mode: with the default ignore_user_abort...
Kévin Dunglas
@dunglas.dev

Also in 1.12.7: routine client-disconnect logs moved from warn to debug (way less noise), a Prometheus thread-count metric fix, and an opcache restart hook removed to avoid recursive restarts. Full notes in the link above.

Kévin Dunglas
@dunglas.dev

Ignore the propaganda in that Qwen ad for a second. The core question for the Left remains valid: boycotting AI is a dead end. AI and robotics give us the tools to build the work-free, post-scarcity utopia envisioned by Lafargue and Bookchin.

Kévin Dunglas
@dunglas.dev

Just improved Caddy performance by fixing header casing on the hot path! 🚀 When using Go's net/http, make sure to use canonical HTTP header casing (e.g. Content-Type instead of content-type). Non-canonical keys trigger string formatting and allocations on every lookup. github.com/caddyserver/...

github.comcaddyhttp: use canonical header key casing to avoid re-canonicalization by dunglas · Pull Request #7911 · caddyserver/caddySummary http.Header.Get/Set re-canonicalize the passed key and allocate a new string whenever it isn't already in canonical MIME header form. Three call sites in the codebase were passing non-c...
Kévin Dunglas
@dunglas.dev

FrankenPHP 1.12.5 is a security release. Upgrade if you run the official Docker images or the session extension as a shared module. Fixed: the default Docker welcome page ran phpinfo() (env vars, php.ini, system paths, all exposed). Now a static page with nothing to leak.

Kévin Dunglas
@dunglas.dev

Also fixed: a cross-request session ID leak in worker mode when the session extension is a shared module. And slow-POST protection is now on by default, a 60s idle timeout on stalled request bodies. Notes: github.com/php/frankenp...

github.comRelease v1.12.5 · php/frankenphpFrankenPHP 1.12.5 is a security release. It fixes two disclosed vulnerabilities — an information leak in the default Docker welcome page and a cross-request session ID leak in worker mode — plus a ...
Kévin Dunglas
@dunglas.dev

🔒 Vulcain 1.4.2 is out, a security release. Fixes 3 vulnerabilities in Preload/Fields directive handling: • High: quadratic response rebuild (DoS) • Medium: unbounded JSON-pointer recursion • Low: HTTP/2 push-counter race Upgrade: github.com/dunglas/vulc...

github.comRelease v1.4.2 · dunglas/vulcainSecurity release fixing three vulnerabilities in request-directive handling, all reported by Alexandre Daubois (Les-Tilleuls.coop). Users on 1.4.1 and earlier should upgrade. 🔒 Security Fixes High...
Kévin Dunglas
@dunglas.dev

The countdown to #APIPlatformCon is on! Incredible speakers, deep-tech talks, and a surprise announcement during my opening keynote. If you are building real-time apps or exploring AI integrations, you need to be in the room. Secure your spot before tickets sell out: 👉 api-platform.com/con/2026/