This Week in PHP Internals | Nov 5, 2026

FrankenPHP recently resolved critical issues including session ID leaks, use-after-free, and double free vulnerabilities. The creator attributed these flaws to state not being reset between requests, as the PHP engine cannot determine when a request ends if the same script serves the subsequent one. Consequently, he intends to implement changes to address this limitation. Additionally, Scalpels now offers one-click open source app installations for Laravel Cloud or Forge accounts to ensure data remains within user infrastructure.