🐘 FrankenPHP 1.13 is out, and it's a big one. @caddyserver 2.11.7 inside: - Slowloris protection with idle read/write timeouts - url_pattern matcher, using the URLPattern web standard - Incremental header (RFC 10036) for streaming responses - SSE behind encode now streams immediately @MercureRealTime 1.0, the stable real-time protocol, built in. Also, mercure_publish() now validates updates and throws on bad input. Config reloads are now validated before replacing the running one: no more 500s after a broken reload. 5 security vulnerabilities fixed, 2 rated high. Upgrade now, and read the upgrade notes first. github.com/php/frankenphp/re…

🚀 Mercure 1.0 alpha is here! The biggest release in the project’s history brings: 🎯 New matcher system built on top of the WHATWG URL Pattern ⚙️ Revamped authorization mechanism using OAuth 2.0 Rich Authorization Requests 🛠️ Brand-new UI debugger and dev playground 🔒 Security hardening 🔄 0.x compatibility mode for easy migration 📖 Read the announcement and try the updated demo: dunglas.dev/2026/08/mercure-…

FrankenPHP 1.12.7 is out, and it fixes a sneaky bug: output written after fastcgi_finish_request() (or frankenphp_finish_request()) could get silently discarded in classic mode, killing the rest of the script right there. If you had cleanup code running after "finish the request early, keep working" patterns, it may never have executed. Also in this release: - Routine client-disconnect logs moved from warn to debug, way less noise - frankenphp_total_threads is now a proper Prometheus gauge instead of an ever-growing counter - Opcache restart hook removed again to avoid recursive restarts under heavy invalidation Full changelog and downloads: github.com/php/frankenphp/re…

FrankenPHP 1.12.5 is out, and it's a security release. Upgrade now if you're running the official Docker images or the session extension as a shared module. Two disclosed vulnerabilities are fixed: 1. The default Docker welcome page ran phpinfo(), leaking environment variables, php.ini directives, and system paths on any derived image that didn't ship its own index. It's now a static page with nothing to disclose. 2. In worker mode, when the session extension was loaded as a shared module, the session ID wasn't reset between requests. A client could end up with another client's session. Also new: slow-POST protection is on by default. A stalled request body used to hold a PHP thread for the life of the connection; php_server/php deployments now enforce a 60s idle timeout on body reads out of the box, matching nginx's client_body_timeout. Configurable via request_body_timeout, or WithRequestBodyTimeout for library users. Plus a handful of crash and hang fixes in worker mode and the CGI layer. Release notes: github.com/php/frankenphp/re…