# FrankenPHP 1.13.5 fixes 17 vulnerabilities, including uploaded files run as PHP; Caddy 2.11.9 fixes FastCGI bypasses · pwn.watch > FrankenPHP 1.13.5, released November 5, is a security release fixing 17 vulnerabilities, most of them found by Anthropic's OSS Scanner. The most severe (High, GHSA-j99q-3wr8-xj43) let php_server run an uploaded non-PHP file as PHP, for instance /uploads/photos.php.php/avatar.jpg, so an attacker able to upload a file under the document root could execute code. Several others affect the default php_server configuration: an open redirect, HTTP/2 Host spoofing, a crash a client can trigger with the official Docker images' PHP settings, and slow request bodies that block every PHP thread. Others include Caddy path-rule bypasses with dot segments and encoded slashes, source disclosure with worker match rules, and session output sent to the wrong client in worker mode. The release bundles Caddy 2.11.9, released the same day, which fixes FastCGI issues of its own: clients overriding HTTP_* variables set with env, encoded-slash and Windows 8.3 short-name path-rule bypasses, HTTP/2 host confusion, and a stricter client_auth being silently dropped when TLS policies merge. Some fixes change behavior and may break apps that rely on the old behavior. Upgrade FrankenPHP to 1.13.5 and Caddy to 2.11.9. Page: https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: high · status: live · patch: patched - Product: FrankenPHP before 1.13.5; Caddy before 2.11.9 (FastCGI / php_fastcgi) - Started: 2026-11-05 - Affected: FrankenPHP before 1.13.5 (some bugs only in 1.12.0+, 1.13.0+ or 1.13.2+); Caddy before 2.11.9 - Fixed in: FrankenPHP 1.13.5; Caddy 2.11.9 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026.json - This file: https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: Caddy 2.11.9 ships, fixing a 2.11.8 regression and FastCGI security issues (GHSA-q34h-28rj-5hjm, GHSA-9cr8-wmhh-39pm and others) plus a TLS client_auth merge bug. (https://github.com/caddyserver/caddy/releases/tag/v2.11.9) - 2026-11-05: FrankenPHP 1.13.5 ships as a security release fixing 17 vulnerabilities, most found by Anthropic's OSS Scanner, and upgrades to Caddy 2.11.9 and Mercure 1.1.6. (https://github.com/php/frankenphp/releases/tag/v1.13.5) ## Fix brief # Security brief: FrankenPHP 1.13.5 fixes 17 vulnerabilities, including uploaded files run as PHP; Caddy 2.11.9 fixes FastCGI bypasses Source: https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026 · status: live · severity: high · updated Nov 5, 2026, 12:58 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is FrankenPHP 1.13.5, released November 5, is a security release fixing 17 vulnerabilities, most of them found by Anthropic's OSS Scanner. The most severe (High, GHSA-j99q-3wr8-xj43) let php_server run an uploaded non-PHP file as PHP, for instance /uploads/photos.php.php/avatar.jpg, so an attacker able to upload a file under the document root could execute code. Several others affect the default php_server configuration: an open redirect, HTTP/2 Host spoofing, a crash a client can trigger with the official Docker images' PHP settings, and slow request bodies that block every PHP thread. Others include Caddy path-rule bypasses with dot segments and encoded slashes, source disclosure with worker match rules, and session output sent to the wrong client in worker mode. The release bundles Caddy 2.11.9, released the same day, which fixes FastCGI issues of its own: clients overriding HTTP_* variables set with env, encoded-slash and Windows 8.3 short-name path-rule bypasses, HTTP/2 host confusion, and a stricter client_auth being silently dropped when TLS policies merge. Some fixes change behavior and may break apps that rely on the old behavior. Upgrade FrankenPHP to 1.13.5 and Caddy to 2.11.9. Severity detail: FrankenPHP rates the worst bug High; it needs the ability to upload a file under the document root. Most other bugs are Medium or Low. - Product: FrankenPHP before 1.13.5; Caddy before 2.11.9 (FastCGI / php_fastcgi) ## Affected versions - FrankenPHP before 1.13.5 (some bugs only in 1.12.0+, 1.13.0+ or 1.13.2+) - Caddy before 2.11.9 ## Check whether you're affected Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions: ```sh php -v php -r 'echo PHP_VERSION, PHP_EOL;' ``` ## Fix Upgrade to one of these fixed versions (or later on the same branch): - FrankenPHP 1.13.5 - Caddy 2.11.9 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Nov 5, 2026: Caddy 2.11.9 ships, fixing a 2.11.8 regression and FastCGI security issues (GHSA-q34h-28rj-5hjm, GHSA-9cr8-wmhh-39pm and others) plus a TLS client_auth merge bug. - Nov 5, 2026: FrankenPHP 1.13.5 ships as a security release fixing 17 vulnerabilities, most found by Anthropic's OSS Scanner, and upgrades to Caddy 2.11.9 and Mercure 1.1.6. ## Advisories - [FrankenPHP v1.13.5 release notes](https://github.com/php/frankenphp/releases/tag/v1.13.5) (FrankenPHP) - [Caddy v2.11.9 release notes](https://github.com/caddyserver/caddy/releases/tag/v2.11.9) (Caddy) - [GHSA-j99q-3wr8-xj43](https://github.com/php/frankenphp/security/advisories/GHSA-j99q-3wr8-xj43) (FrankenPHP) --- Machine-readable: https://pwn.watch/i/frankenphp-1-13-5-caddy-2-11-9-security-releases-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.