v5.0.3

🔐 Security update: PHP session upload progress and FrankenPHP 1.13.2

Important

Pull and redeploy. PHP has announced a new remote code execution vulnerability (CVE-2026-115560) that isn't fixed yet. It's separate from the two CVEs that v5.0.2 patched, so v5.0.2 doesn't protect you from it. This release turns off session upload progress, which blocks it. The FrankenPHP images also move to FrankenPHP 1.13.2.

Note

These issues are in php/php-src and php/frankenphp upstream, not in this repo. PHP versions are the same as v5.0.2.

---

A new PHP vulnerability, not yet fixed

CVE	Issue	PHP fix
CVE-2026-115560	Remote code execution through session upload progress	Not released yet. PHP will publish the details and the fix in its next regular release.

This is a different vulnerability from CVE-2026-109618 and CVE-2026-109619, which PHP fixed on October 21. Updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 doesn't fix it.

Until PHP ships the fix, they recommend turning off session upload progress. That's what this release does. The same setting was already a suggested workaround for CVE-2026-109619. If you turned it off yourself on October 21, keep it off.

Your app is only exposed if all of these are true:

1. session.serialize_handler is set to php_binary or php_serialize in your config
2. Your code switches it to php with ini_set() before calling session_start()
3. Session upload progress is enabled (PHP's default)

Our images default session.serialize_handler to php. That makes this unlikely. We'd still rather ship the safe default than have you check every app by hand.

Who this affects

Only apps that read upload progress from $_SESSION.

If you need it and never change session.serialize_handler at runtime, turn it back on:

services:
  php:
    image: serversideup/php:8.4-fpm-nginx
    environment:
      PHP_SESSION_UPLOAD_PROGRESS_ENABLED: "1"

We'll revisit this default once PHP ships its fix.

🐘 FrankenPHP v1.13.2

FrankenPHP 1.13.2 came out after v5.0.2 was built. It fixes these issues in FrankenPHP itself:

Advisory	Issue
GHSA-fq24-r53r-xcx3	An unauthenticated client could keep every PHP thread busy by queuing requests and disconnecting
GHSA-4gfw-9v29-gp9h	In worker mode, error_get_last() and libxml_get_errors() could leak a previous request's input and server paths
GHSA-ccgp-ch9h-533f	A self-referencing array passed to frankenphp_log() or a worker callback crashed the whole process

It also makes frankenphp_log() available in php-cli. Hot reload no longer serves stale pages.

Only the frankenphp images include FrankenPHP.

How to update

If you use	Example	Do this
A floating tag	8.4-fpm-nginx	Pull and redeploy
A release tag	8.4-fpm-nginx-v5.0.2	Change it to 8.4-fpm-nginx-v5.0.3
A patch version tag	8.4.27-fpm-nginx	Pull and redeploy

Then confirm the setting is off:

docker compose exec php php -i | grep session.upload_progress.enabled

On FrankenPHP, confirm the version too:

docker compose exec php frankenphp version

What's Changed

• Security: Add PHP_SESSION_UPLOAD_PROGRESS_ENABLED and default it to 0 by @jaydrogers
• Security: Update FrankenPHP to v1.13.2 by @jaydrogers

Full Changelog: v5.0.2...v5.0.3