FrankenPHP 1.13.5 fixes 17 vulnerabilities, including uploaded files run as PHP; Caddy 2.11.9 fixes FastCGI bypasses ยท updates https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026 FrankenPHP 1.13.5, released November 5, is a security release fixing 17 vulnerabilities, most of them found by Anthropic's OSS Scanner. The most severe (High, GHSA-j99q-3wr8-xj43) let php_server run an uploaded non-PHP file as PHP, for instance /uploads/photos.php.php/avatar.jpg, so an attacker able to upload a file under the document root could execute code. Several others affect the default php_server configuration: an open redirect, HTTP/2 Host spoofing, a crash a client can trigger with the official Docker images' PHP settings, and slow request bodies that block every PHP thread. Others include Caddy path-rule bypasses with dot segments and encoded slashes, source disclosure with worker match rules, and session output sent to the wrong client in worker mode. The release bundles Caddy 2.11.9, released the same day, which fixes FastCGI issues of its own: clients overriding HTTP_* variables set with env, encoded-slash and Windows 8.3 short-name path-rule bypasses, HTTP/2 host confusion, and a stricter client_auth being silently dropped when TLS policies merge. Some fixes change behavior and may break apps that rely on the old behavior. Upgrade FrankenPHP to 1.13.5 and Caddy to 2.11.9. en Thu, 05 Nov 2026 00:00:00 GMT FrankenPHP 1.13.5 fixes 17 vulnerabilities, including uploaded files run as PHP; Caddy 2.11.9 fixes FastCGI bypasses: Caddy 2.11.9 ships, fixing a 2.11.8 regression and FastCGI security issues (GHSA-q34h-28rj-5hjm, GHSA-9cr8-wmhh-39pm and others) plus a TLS client_auth merge bug. https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026 https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026#2026-11-05-c8c50184 Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/caddyserver/caddy/releases/tag/v2.11.9">Source</a></p> FrankenPHP 1.13.5 fixes 17 vulnerabilities, including uploaded files run as PHP; Caddy 2.11.9 fixes FastCGI bypasses: FrankenPHP 1.13.5 ships as a security release fixing 17 vulnerabilities, most found by Anthropic's OSS Scanner, and upgrades to Caddy 2.11.9 and Mercure 1.1.6. https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026 https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026#2026-11-05-8856b55f Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/php/frankenphp/releases/tag/v1.13.5">Source</a></p>