Post

Kévin Dunglas
@dunglas.dev

FrankenPHP 1.12.5 is a security release. Upgrade if you run the official Docker images or the session extension as a shared module. Fixed: the default Docker welcome page ran phpinfo() (env vars, php.ini, system paths, all exposed). Now a static page with nothing to leak.

1 repost10 likes

Kévin Dunglas
@dunglas.dev

Also fixed: a cross-request session ID leak in worker mode when the session extension is a shared module. And slow-POST protection is now on by default, a 60s idle timeout on stalled request bodies. Notes: github.com/php/frankenp...

github.comRelease v1.12.5 · php/frankenphpFrankenPHP 1.12.5 is a security release. It fixes two disclosed vulnerabilities — an information leak in the default Docker welcome page and a cross-request session ID leak in worker mode — plus a ...