[Revue de presse] Dans les coulisses de la crise qui a touché PHP ces derniers jours, notre coopérateur @alexdaubois revient dans Libération sur la gestion sous tension des deux failles critiques dévoilées il y a quelques jours : liberation.fr/economie/econo…

Learn with @s0yuka how AI coding agents interact with convention-heavy frameworks, why they bypass them, and how to effectively steer them using AGENTS.md files: les-tilleuls.coop/en/blog/coding…

Last week, PHP urgently released fixes for critical security vulnerabilities, serving as a stark reminder that roughly 70% of the web relies on the shoulders of just a few dozen core developers.

Read more about why investing in open source matters: les-tilleuls.coop/en/blog/who-ke…

Apart from the header crash, introduced in 1.13.2 by a dependency change, none of these FrankenPHP vulnerabilities were exploitable in common setups, including Symfony and Laravel. They need specific app code or advanced config, like request-specific placeholders in env.

🔒 FrankenPHP 1.13.4 is out. It's a security release: upgrade now.

It fixes 7 vulnerabilities, mostly in worker mode:

- A single unauthenticated request could crash the whole server (1.13.2 and 1.13.3)
- Per-request environment variables and upstream response headers leaked into later requests
- Use-after-free bugs triggered by putenv() during shutdown and by SplTempFileObject

Docker images and Windows builds now ship Brotli 1.2.1 against CVE-2026-111497 (Node2Shell), and Windows and macOS binaries are built with Go 1.27.3.

FrankenPHP has also been selected for @AnthropicAI's OSS Scanner program, which regularly scans it for vulnerabilities.

Need help upgrading or securing your PHP stack? @coopTilleuls provides support, consulting and training: contact@les-tilleuls.coop

github.com/php/frankenphp…

Talks by @DianaWebdev, @vanamerongen, @helvira_g, and @nicolasgrekas are now live on @coopTilleuls' YouTube channel: youtube.com/@coopTilleuls

If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF

🚨 FrankenPHP 1.13.2 is officially live!

This is a security release patching a critical PHP vulnerability (PHP2Shell) alongside 4 vulnerabilities in FrankenPHP itself.

Upgrading immediately is strongly recommended:

🐳 Docker: Refreshed! 1.13.1 (PHP 8.5.12) and all 1.13.2 images (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12) are ready.
⚙️ Binaries: Static binaries published with patched PHP 8.5.12.

A big thanks to @alexdaubois, Marc Henderkes, the @ThePHPF, and everyone involved!

All details: github.com/php/frankenphp…

🚨 The PHP team announced a critical security release fixing two vulnerabilities rated 9.2/10 (CVSS v4.0). We're working directly with @ThePHPF to release a patched version of FrankenPHP ASAP.

Need help securing, upgrading, or maintaining your app? We got you.

Three new talks from #APIPlatformCon 2026 are now live on @coopTilleuls' YouTube channel! This week, we're focusing on #FrankenPHP and its ecosystem with inspiring presentations from @brendt_gd, @beberlei, and @johanjanssens.

Enjoy watching, and don't forget to subscribe: youtube.com/@coopTilleuls

Chaque lundi, les conférences issues de l'#APIPlatformCon 2026 sont partagées sur notre chaîne YouTube et cette semaine, nous vous invitons à découvrir les conférences francophones axées sur FrankenPHP. Bon visionnage !
➡️ youtube.com/@coopTilleuls

Talks by @yOyO38, @beoneself, and @alexdaubois from the #APIPlatformCon 2026 are now available on @coopTilleuls' YouTube channel: youtube.com/@coopTilleuls

Talks by @dunglas, @s0yuka, and @MarionHerisson given at the #APIPlatformCon 2026 are now available on YouTube: youtube.com/playlist?list=…

🐘 FrankenPHP 1.13 is out, and it's a big one.

@caddyserver 2.11.7 inside:
- Slowloris protection with idle read/write timeouts
- url_pattern matcher, using the URLPattern web standard
- Incremental header (RFC 10036) for streaming responses
- SSE behind encode now streams immediately

@MercureRealTime 1.0, the stable real-time protocol, built in. Also, mercure_publish() now validates updates and throws on bad input.

Config reloads are now validated before replacing the running one: no more 500s after a broken reload.

5 security vulnerabilities fixed, 2 rated high. Upgrade now, and read the upgrade notes first.

github.com/php/frankenphp…

Tomorrow, talks by @dunglas, @s0yuka, and @MarionHerisson will be available on @coopTilleuls's YouTube channel. Subscribe now: youtube.com/@coopTilleuls

Watch the #APIPlatformCon 2026 Aftermovie!
youtube.com/watch?v=DD-q0B…

API Platform 4.4 & 5.0 sont disponibles ! Publiées il y a quelques jours lors de l’#APIPlatformCon, ces versions apportent un nouveau système de filtres, le support d'OpenAPI 3.2, des ID JSON:API officiels ainsi que la compatibilité avec Symfony 7.4 et 8 : les-tilleuls.coop/blog/sortie-ap…

Would you like to watch the #APIPlatformCon 2026 aftermovie?

Plus que quelques jours avant le #ForumPHP ! Découvrez l'interview de @s0yuka qui revient sur l'intégration du protocole MCP dans @ApiPlatform 4.3 et comment les choix d'archi du framework avaient été conçus pour les machines bien avant l'arrivée des LLM : event.afup.org/forumphp2026-i…

#APIPlatformCon 2026 was a blast! Thanks to all the speakers, sponsors, participants, and staff for your energy and kindness. Pictures are now available on Flickr, huge kudos to @nclsdtrz for the shots: flickr.com/photos/1940525…