
Founder of @coopTilleuls, a tech worker cooperative. Free Software creator: @ApiPlatform, @MercureRealTime, #FrankenPHP and many more!
Lille, France
Joined April 2008
- Tweets18.2K
- Following527
- Followers14.6K
- Likes18K
Pinned Tweet
🧟Official native Windows support for FrankenPHP is here. 🪟🚀
✅ Rely on official PHP Windows binaries
✅ Support all FrankenPHP features, including worker mode and hot reloading
✅ Full PHP extension support
⚡️ Up to 3.6x faster than Nginx/PHP-FPM on Windows!
Try it and read the full story on how we made it happen: dunglas.dev/2026/03/windows-…
Thanks to @Info_IntelX and @coopTilleuls for having sponsored this feature!
#PHP #golang #Windows
Kévin Dunglas retweeted
Explore with @dunglas the new features in @caddyserver 2.11, including Slowloris protection, URLPattern routing, OTLP metrics, and our latest contributions to FrankenPHP and @MercureRealTime: tilia.coop/caddy-2-11-contri…
Kévin Dunglas retweeted
🚨 ATTENTION! People are mistranslating what I said!
I NEVER said people should block far-right accounts. I said they should IGNORE THEIR POSTS!
Blocking actually works against this strategy because the algorithm will understand that you didn’t see the content simply because you blocked the account.
However, when a post appears in your feed and you ignore it, you don’t read it, don’t like it, don’t comment on it, or engage with it in any way , the algorithm will interpret that content as irrelevant because it was shown to you and you chose not to engage with it!
THERE IS A HUGE DIFFERENCE BETWEEN BLOCKING CONTENT AND IGNORING IT!
And it's a winning strategy!
Stuff like the "leave X" push was such a massive shot in the foot for the left (plenty of us warned about it). Same with the whole "anti-AI" trend. Bringing bare hands to a gunfight against people with M16s has never ended well.
"The Brazilian left took years to understand an uncomfortable truth: you cannot win an internet street fight with the manners of a university professor. For far too long, the Workers' Party reacted to the digital dirty war as if it were writing a doctoral dissertation. When the far-right machinery unleashed an incendiary hoax first thing in the morning about the closure of churches or the destruction of the family, the party leadership would call endless meetings, consult its lawyers, and release, well into the night, an unreadable three-page statement in a language no one outside headquarters understood. By then, the lie had already penetrated the phones of fifteen million families and shaped the panic of half the country.
Lula’s campaign slammed head-on into the reality of screens. In the mud of TikTok and WhatsApp, solemn denials and fact-checking seals barely move anyone; they are blank ammunition against an emotional missile. If they wanted to stop the bleeding, they had to stop lecturing from a pulpit and start playing by the very rules that govern the internet: savage speed, shameless humor, and zero bureaucracy."
Kévin Dunglas retweeted
Apart from the header crash, introduced in 1.13.2 by a dependency change, none of these FrankenPHP vulnerabilities were exploitable in common setups, including Symfony and Laravel. They need specific app code or advanced config, like request-specific placeholders in env.
🔒 FrankenPHP 1.13.4 is out. It's a security release: upgrade now.
It fixes 7 vulnerabilities, mostly in worker mode:
- A single unauthenticated request could crash the whole server (1.13.2 and 1.13.3)
- Per-request environment variables and upstream response headers leaked into later requests
- Use-after-free bugs triggered by putenv() during shutdown and by SplTempFileObject
Docker images and Windows builds now ship Brotli 1.2.1 against CVE-2026-111497 (Node2Shell), and Windows and macOS binaries are built with Go 1.27.3.
FrankenPHP has also been selected for @AnthropicAI's OSS Scanner program, which regularly scans it for vulnerabilities.
Need help upgrading or securing your PHP stack? @coopTilleuls provides support, consulting and training: [email protected]
github.com/php/frankenphp/re…
Kévin Dunglas retweeted
🎤 À l'#APIPlatformCon, @medjawii recevait Emmanuel Durand, @beoneself, @dunglas et @lostinbrittany pour une table ronde tech x A La French Podcast !
Au programme : 35 min de débats sur nos choix, parcours et engagements : youtube.com/watch?v=EEShIRFF…
🚨 FrankenPHP 1.13.2 is officially live!
This is a security release patching a critical PHP vulnerability (PHP2Shell) alongside 4 vulnerabilities in FrankenPHP itself.
Upgrading immediately is strongly recommended:
🐳 Docker: Refreshed! 1.13.1 (PHP 8.5.12) and all 1.13.2 images (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12) are ready.
⚙️ Binaries: Static binaries published with patched PHP 8.5.12.
A big thanks to @alexdaubois, Marc Henderkes, the @ThePHPF, and everyone involved!
All details: github.com/php/frankenphp/re…
macOS binary available.
🚨 Critical PHP vulnerability update 🚨
Patched PHP versions have officially been released!
Here is the latest status on FrankenPHP:
⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac…
🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours
🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready
💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
PHP vulnerability:
The patched Linux and Windows FrankenPHP binaries are out! Still waiting on the macOS build and the official PHP Docker images to wrap up, though.
github.com/php/frankenphp/re…
🚨 Critical PHP vulnerability update 🚨
Patched PHP versions have officially been released!
Here is the latest status on FrankenPHP:
⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac…
🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours
🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready
💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
🚨 Critical PHP vulnerability update 🚨
Patched PHP versions have officially been released!
Here is the latest status on FrankenPHP:
⚙️ Binaries: FrankenPHP 1.13.1 binaries with patched PHP 8.5 are currently building: github.com/php/frankenphp/ac…
🐳 Docker: Waiting on upstream patched Docker images before rebuilding ours
🏷️ Next Release: FrankenPHP 1.13.2 (including unrelated bug and security fixes) will be tagged as soon as 1.13.2 binaries and Docker images are ready
💙 Maintaining open-source projects takes serious effort. Consider supporting the work via GitHub Sponsors and donating to the PHP Foundation!
Kévin Dunglas retweeted
🚨 The PHP team announced a critical security release fixing two vulnerabilities rated 9.2/10 (CVSS v4.0). We're working directly with @ThePHPF to release a patched version of FrankenPHP ASAP.
Need help securing, upgrading, or maintaining your app? We got you.
Kévin Dunglas retweeted
Your PHP app already runs Mercure? Your AI agent can now stream through it. 📡
Neuron splits what's too big, paces what's too fast, and the browser rebuilds it all in order. Already on FrankenPHP? Mercure ships with it.
Mercure is built by @coopTilleuls
#PHP #Mercure
Kévin Dunglas retweeted
More of this please! Let’s not fall in extreme oposites. AI is a good and useful technology by the positive extreme is ignoring all consequences and the negative extreme is taking it too far
Like most capitalist products, commercial LLMs are an ecological, social, and economic aberration in how they're built and deployed.
We must fix this by building democratically controlled public AI services, rationing water and power, fairly compensating workers extracting raw materials needed for hardware and training-data creators, and banning harmful or useless use cases.
We need this alternative all the more because I fully agree with Linus Torvalds: these tools are impressive, and refusing them outright is unprofessional. Weeks of senior dev labor can no longer match what AI uncovers in minutes regarding security flaws, bugs, and performance optimization!
Like most capitalist products, commercial LLMs are an ecological, social, and economic aberration in how they're built and deployed.
We must fix this by building democratically controlled public AI services, rationing water and power, fairly compensating workers extracting raw materials needed for hardware and training-data creators, and banning harmful or useless use cases.
We need this alternative all the more because I fully agree with Linus Torvalds: these tools are impressive, and refusing them outright is unprofessional. Weeks of senior dev labor can no longer match what AI uncovers in minutes regarding security flaws, bugs, and performance optimization!
Fighting planned obsolescence with AI 🌻
Learn with @s0yuka how his team used AI agents and a €15 adapter to reverse-engineer a 15-year-old heating controller, recover its missing source code, and bring their legacy office infrastructure directly into Home Assistant.
Read the full story here tilia.coop/home-assistant-le…
Kévin Dunglas retweeted
What if we connect a cluster of @MercureRealTime to a @MongoDB. Thanks to the MongoDB event stream, events are broadcasted to every instances and the subscribers (clients) are notified in real time.




















