Kévin Dunglas (@dunglas) header
Kévin Dunglas (@dunglas) profile picture

Founder of @coopTilleuls, a tech worker cooperative. Free Software creator: @ApiPlatform, @MercureRealTime, #FrankenPHP and many more!

Lille, France
Joined April 2008
Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)Photo by Kévin Dunglas (@dunglas)
🧟Official native Windows support for FrankenPHP is here. 🪟🚀 ✅ Rely on official PHP Windows binaries ✅ Support all FrankenPHP features, including worker mode and hot reloading ✅ Full PHP extension support ⚡️ Up to 3.6x faster than Nginx/PHP-FPM on Windows! Try it and read the full story on how we made it happen: dunglas.dev/2026/03/windows-… Thanks to @Info_IntelX and @coopTilleuls for having sponsored this feature! #PHP #golang #Windows
5
43
6
235
14,978
Kévin Dunglas retweeted
Explore with @dunglas the new features in @caddyserver 2.11, including Slowloris protection, URLPattern routing, OTLP metrics, and our latest contributions to FrankenPHP and @MercureRealTime: tilia.coop/caddy-2-11-contri…
5
5
300
Kévin Dunglas retweeted
🚨 ATTENTION! People are mistranslating what I said! I NEVER said people should block far-right accounts. I said they should IGNORE THEIR POSTS! Blocking actually works against this strategy because the algorithm will understand that you didn’t see the content simply because you blocked the account. However, when a post appears in your feed and you ignore it, you don’t read it, don’t like it, don’t comment on it, or engage with it in any way , the algorithm will interpret that content as irrelevant because it was shown to you and you chose not to engage with it! THERE IS A HUGE DIFFERENCE BETWEEN BLOCKING CONTENT AND IGNORING IT!
2,864
43,283
2,485
138,030
2,793,947
And it's a winning strategy! Stuff like the "leave X" push was such a massive shot in the foot for the left (plenty of us warned about it). Same with the whole "anti-AI" trend. Bringing bare hands to a gunfight against people with M16s has never ended well. "The Brazilian left took years to understand an uncomfortable truth: you cannot win an internet street fight with the manners of a university professor. For far too long, the Workers' Party reacted to the digital dirty war as if it were writing a doctoral dissertation. When the far-right machinery unleashed an incendiary hoax first thing in the morning about the closure of churches or the destruction of the family, the party leadership would call endless meetings, consult its lawyers, and release, well into the night, an unreadable three-page statement in a language no one outside headquarters understood. By then, the lie had already penetrated the phones of fifteen million families and shaped the panic of half the country. Lula’s campaign slammed head-on into the reality of screens. In the mud of TikTok and WhatsApp, solemn denials and fact-checking seals barely move anyone; they are blank ammunition against an emotional missile. If they wanted to stop the bleeding, they had to stop lecturing from a pulpit and start playing by the very rules that govern the internet: savage speed, shameless humor, and zero bureaucracy."
3
1
16
1,988
Kévin Dunglas retweeted
Apart from the header crash, introduced in 1.13.2 by a dependency change, none of these FrankenPHP vulnerabilities were exploitable in common setups, including Symfony and Laravel. They need specific app code or advanced config, like request-specific placeholders in env.
3
1
19
1,572
🔒 FrankenPHP 1.13.4 is out. It's a security release: upgrade now. It fixes 7 vulnerabilities, mostly in worker mode: - A single unauthenticated request could crash the whole server (1.13.2 and 1.13.3) - Per-request environment variables and upstream response headers leaked into later requests - Use-after-free bugs triggered by putenv() during shutdown and by SplTempFileObject Docker images and Windows builds now ship Brotli 1.2.1 against CVE-2026-111497 (Node2Shell), and Windows and macOS binaries are built with Go 1.27.3. FrankenPHP has also been selected for @AnthropicAI's OSS Scanner program, which regularly scans it for vulnerabilities. Need help upgrading or securing your PHP stack? @coopTilleuls provides support, consulting and training: [email protected] github.com/php/frankenphp/re…
9
22
3
170
9,693
Apart from the header crash, introduced in 1.13.2 by a dependency change, none of these FrankenPHP vulnerabilities were exploitable in common setups, including Symfony and Laravel. They need specific app code or advanced config, like request-specific placeholders in env.
3
1
19
1,572
Kévin Dunglas retweeted
You gotta be kidding me.
No wonder people think PHP is dead. Turns out... nope.
245
680
177
12,776
461,430
Kévin Dunglas retweeted
🎤 À l'#APIPlatformCon, @medjawii recevait Emmanuel Durand, @beoneself, @dunglas et @lostinbrittany pour une table ronde tech x A La French Podcast ! Au programme : 35 min de débats sur nos choix, parcours et engagements : youtube.com/watch?v=EEShIRFF…
2
5
461
🚨 FrankenPHP 1.13.2 is officially live! This is a security release patching a critical PHP vulnerability (PHP2Shell) alongside 4 vulnerabilities in FrankenPHP itself. Upgrading immediately is strongly recommended: 🐳 Docker: Refreshed! 1.13.1 (PHP 8.5.12) and all 1.13.2 images (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12) are ready. ⚙️ Binaries: Static binaries published with patched PHP 8.5.12. A big thanks to @alexdaubois, Marc Henderkes, the @ThePHPF, and everyone involved! All details: github.com/php/frankenphp/re…
15
15
2
131
5,439
macOS binary available.
🚨 Critical PHP vulnerability update 🚨 Patched PHP versions have officially been released! Here is the latest status on FrankenPHP: ⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac… 🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours 🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready 💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
15
2,234
PHP vulnerability: The patched Linux and Windows FrankenPHP binaries are out! Still waiting on the macOS build and the official PHP Docker images to wrap up, though. github.com/php/frankenphp/re…
🚨 Critical PHP vulnerability update 🚨 Patched PHP versions have officially been released! Here is the latest status on FrankenPHP: ⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac… 🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours 🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready 💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
7
10
2
61
4,171
Patched Windows FrankenPHP release available.
Replying to @dunglas
need windows release!
1
19
1,885
🚨 Critical PHP vulnerability update 🚨 Patched PHP versions have officially been released! Here is the latest status on FrankenPHP: ⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac… 🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours 🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready 💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
17
33
6
177
18,563
Kévin Dunglas retweeted
🚨 The PHP team announced a critical security release fixing two vulnerabilities rated 9.2/10 (CVSS v4.0). We're working directly with @ThePHPF to release a patched version of FrankenPHP ASAP. Need help securing, upgrading, or maintaining your app? We got you.
4
6
44
3,429
Your PHP app already runs Mercure? Your AI agent can now stream through it. 📡 Neuron splits what's too big, paces what's too fast, and the browser rebuilds it all in order. Already on FrankenPHP? Mercure ships with it. Mercure is built by @coopTilleuls #PHP #Mercure
1
3
6
433
Kévin Dunglas retweeted
More of this please! Let’s not fall in extreme oposites. AI is a good and useful technology by the positive extreme is ignoring all consequences and the negative extreme is taking it too far
Like most capitalist products, commercial LLMs are an ecological, social, and economic aberration in how they're built and deployed. We must fix this by building democratically controlled public AI services, rationing water and power, fairly compensating workers extracting raw materials needed for hardware and training-data creators, and banning harmful or useless use cases. We need this alternative all the more because I fully agree with Linus Torvalds: these tools are impressive, and refusing them outright is unprofessional. Weeks of senior dev labor can no longer match what AI uncovers in minutes regarding security flaws, bugs, and performance optimization!
1
269
Like most capitalist products, commercial LLMs are an ecological, social, and economic aberration in how they're built and deployed. We must fix this by building democratically controlled public AI services, rationing water and power, fairly compensating workers extracting raw materials needed for hardware and training-data creators, and banning harmful or useless use cases. We need this alternative all the more because I fully agree with Linus Torvalds: these tools are impressive, and refusing them outright is unprofessional. Weeks of senior dev labor can no longer match what AI uncovers in minutes regarding security flaws, bugs, and performance optimization!
1
1
1
26
1,798
Fighting planned obsolescence with AI 🌻
Learn with @s0yuka how his team used AI agents and a €15 adapter to reverse-engineer a 15-year-old heating controller, recover its missing source code, and bring their legacy office infrastructure directly into Home Assistant. Read the full story here tilia.coop/home-assistant-le…
2
11
635
Kévin Dunglas retweeted
What if we connect a cluster of @MercureRealTime to a @MongoDB. Thanks to the MongoDB event stream, events are broadcasted to every instances and the subscribers (clients) are notified in real time.
1
5
1
8
691