FrankenPHP embeds PHP. PHP’s CVE-2026-109618 advisory says FrankenPHP, like mod_php, calls request shutdown unconditionally, which makes application-independent attacks likely. The advisory does not say a complete FrankenPHP exploit was included in the public validation the way mod_php’s was. For CVE-2026-109619, PHP says an equivalent early configuration consumer was not established in the default FrankenPHP configuration, and that this does not make the SAPI immune.
You update FrankenPHP by replacing the binary or image that contains the embedded PHP, not by updating a system php-fpm you are not using. Official image tags were not independently confirmed in this review. Read the FrankenPHP release notes for a build that contains PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a stated backport, and then check the binary inside the running container.
docker compose or Kubernetes will keep the old container until the task is replaced. Restart the service and confirm the new image digest. A copied Caddyfile does not carry the patch.
Worker mode still reuses a process across requests, which is the shape both advisories care about. Apply session.upload_progress.enabled=0 in the PHP configuration the binary actually reads if you need a temporary reduction, and schedule the binary update in the same week.