FrankenPHP
Security incidents tagged FrankenPHP. Newest first.
1 FrankenPHP incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 0 days
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
FrankenPHP 1.13.5 fixes 17 vulnerabilities, including uploaded files run as PHP; Caddy 2.11.9 fixes FastCGI bypasses
FrankenPHP 1.13.5, released November 5, is a security release fixing 17 vulnerabilities, most of them found by Anthropic's OSS Scanner. The most severe (High, GHSA-j99q-3wr8-xj43) let php_server run an uploaded non-PHP file as PHP, for instance /uploads/photos.php.php/avatar.jpg, so an attacker able to upload a file under the document root could execute code. Several others affect the default php_server configuration: an open redirect, HTTP/2 Host spoofing, a crash a client can trigger with the official Docker images' PHP settings, and slow request bodies that block every PHP thread. Others include Caddy path-rule bypasses with dot segments and encoded slashes, source disclosure with worker match rules, and session output sent to the wrong client in worker mode. The release bundles Caddy 2.11.9, released the same day, which fixes FastCGI issues of its own: clients overriding HTTP_* variables set with env, encoded-slash and Windows 8.3 short-name path-rule bypasses, HTTP/2 host confusion, and a stricter client_auth being silently dropped when TLS policies merge. Some fixes change behavior and may break apps that rely on the old behavior. Upgrade FrankenPHP to 1.13.5 and Caddy to 2.11.9.
FrankenPHP before 1.13.5; Caddy before 2.11.9 (FastCGI / php_fastcgi)Since Nov 5, 2026
