FrankenPHP 1.13.2 was published on 21 October 2026. The release updates the PHP versions bundled with its Docker images to 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Static binaries use PHP 8.5.12. These versions address PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. The two critical vulnerabilities allow unauthenticated remote code execution, and upgrading is the only complete mitigation identified in the release notes.

Four additional vulnerabilities in FrankenPHP are fixed. An embedded-app extraction flaw, rated high severity and tracked as GHSA-6q3j-62j9-f9hh, allowed a local user to prepare a predictable directory in the shared temporary area and make the service execute their PHP code. FrankenPHP now extracts applications atomically into a per-user directory. An existing directory is reused only when it belongs to the current user.

Requests waiting for a PHP thread are now discarded after the client disconnects. Previously, an unauthenticated client could occupy the thread pool by queueing requests and closing the connection. GHSA-fq24-r53r-xcx3 covers this issue.

Self-referencing PHP arrays are rejected during conversion to Go values. Before the fix, such an array passed to `frankenphp_log()`, returned by a worker callback or supplied through the extension API could overflow the stack and crash the process. This issue is tracked as GHSA-ccgp-ch9h-533f. In worker mode, `error_get_last()` and `libxml_get_errors()` are cleared after each request, preventing fragments of a previous client's input and server paths from reaching the next request. That issue is GHSA-4gfw-9v29-gp9h.

The `frankenphp_log()` function and the `FRANKENPHP_LOG_LEVEL_*` constants are now available in `php-cli`. They use the server log format and write to stderr. The Caddyfile is not loaded for CLI execution, so its logging directives do not apply. The extension function `frankenphp_thread_index()` is exported again for C extensions including `frankenstate` and `frankenasync`.

Static builds now use static-php-cli v3. macOS packages are published only for Apple Silicon, so the `frankenphp-mac-x86_64` asset has been removed. Intel Mac users must build from source with `build-static.sh`. The `-gnu` binary now requires glibc 2.28 or newer instead of 2.17.

Static builder images now receive `PHP_EXTENSIONS`, `PHP_EXTENSION_LIBS`, `XCADDY_ARGS` and other options as environment variables passed to `docker run`, not as Docker build arguments. The output binary is written to the mounted `/output` directory, and default settings are stored in `craft.yml`. The static build documentation has been updated for this process.

Hot reload now sets `opcache.revalidate_freq` to 0 when `hot_reload` is configured. This prevents a changed page from being served from stale cache. Values from `php.ini`, `PHP_INI_SCAN_DIR` or the `php_ini` directive still take precedence. Caddy now parses thread and request limits as integers. On `linux/386`, `linux/arm/v6` and `linux/arm/v7`, values outside the range return an error instead of wrapping to a negative number. The previous value `max_threads 4294967295` therefore no longer means automatic sizing.

The static-build header `types.h` has been renamed to `frankenphp_types.h` because a libwebp header with the same name could break compilation. Documentation now covers publishing Mercure updates from `php-cli` through the hub's POST endpoint. It also explains why detecting `mercure_publish()` during cache warming disables that function in the web server.

The release includes a Russian translation fix. First contributions were recorded from @chubakur in #2712 and @zaccesss in #2726. @nickchomey contributed in #2717, and @sergehardy in #1926.