Intelligence View

⚡ tsecurity.de Intelligence

FrankenPHP: The Modern PHP App Server, written in Go

FrankenPHP is a modern PHP application server built on the Caddy web server, offering developers a powerful alternative to traditional setups like PHP-FPM and Nginx. In this article, I'll explore how FrankenPHP improves performance,…

Sichere Programmierung dev.to 12.09.2024, 22:31 Uhr 4 Min. Lesezeit KRITIS / Energie Cloud & IT-Enterprise

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

FrankenPHP is a modern PHP application server built on the Caddy web server, offering developers a powerful alternative to traditional setups like PHP-FPM and Nginx. In this article, I'll explore how FrankenPHP improves performance, simplifies deployment, and enhances security with cutting-edge features like worker mode, real-time event support, and automatic HTTPS. Whether you're working with Laravel, Symfony, WordPress, or other PHP frameworks, discover why FrankenPHP is quickly becoming the go-to solution for developers seeking to optimize their production environments.

If you're a PHP developer looking to improve your application’s performance, security, and deployment process, it's time to consider switching to FrankenPHP as your production web server. Built on the robust Caddy web server, FrankenPHP brings modern innovations that traditional setups like PHP-FPM and Nginx can’t match.

With features like worker mode, which keeps your app in memory for faster performance, and real-time event capabilities that allow seamless communication between your app and the browser, FrankenPHP can significantly boost your app's responsiveness and user experience. It also supports automatic HTTPS, HTTP/2, and HTTP/3, ensuring your app is secure and uses the latest web protocols without any additional configuration.

FrankenPHP also simplifies your deployment by packaging your app as a standalone binary, eliminating the need for managing multiple processes like PHP-FPM and Nginx. Whether you work with Laravel, Symfony, WordPress, or any other PHP framework, FrankenPHP will make your app faster, more efficient, and easier to manage.

For developers looking to streamline their workflow and deliver better performance to end users, switching to FrankenPHP is a smart move. Start exploring today and elevate your PHP projects to the next level.

FrankenPHP at a glance:

Caddy Webserver: Uses the official PHP executor embedded in a state-of-the-art web server: Caddy

Extensible: Compatible with PHP 8.2+, most PHP extensions and all Caddy modules.

Only one service: Designed with simplicity in mind: only one service, only one binary! FrankenPHP doesn’t need PHP-FPM, it uses its own SAPI specially handcrafted for Go web servers.

Easy deploy: Cloud Native app shipped as a Docker image. Compatible with Kubernetes, and all modern cloud platforms. It’s also possible to package your PHP app as a standalone, self-executable static binary.

Worker mode: Boot your application once and keep it in memory! It is ready to handle incoming requests in a few milliseconds.

103 Early Hints: Early Hints are a brand new feature of the web platform that can improve website load times by 30%. FrankenPHP is the only PHP SAPI with Early Hints support!

Real-time: Built-in Mercure hub. Send events from your PHP apps to all connected browsers, they instantly receive the payload as a JavaScript event!

Brotli, Zstandard and Gzip compression: Modern compression formats are supported out-of-the-box.

Structured logging: Bring a more defined format and details to your logging.

Prometheus metrics and tracing: Built-in Prometheus support!

HTTP/2 & HTTP/3: Native support for HTTPS, HTTP/2 and HTTP/3.

HTTPS Automation: Automatic HTTPS certificate generation, renewal and revocation.

Graceful reload: Deploy your apps with zero downtime thanks to graceful reloads.

Supports PHP extension: FrankenPHP supports the most popular PHP extensions, including OPcache and XDebug.

One command to run them all

# Docker

docker run -v $PWD:/app -p 443:443 dunglas/frankenphp



# Static binary

./frankenphp php-server



# Command-line script

./frankenphp php-cli /path/to/your/script.php

Benefits of using FrankenPHP

There are many benefits to using FrankenPHP, including:

Improved performance: FrankenPHP can significantly improve the performance of your PHP app, especially in worker mode.
Reduced complexity: FrankenPHP simplifies your deployment process by eliminating the need for separate PHP-FPM and Nginx processes.

Increased security: FrankenPHP automatically supports HTTPS, HTTP/2, and HTTP/3, which helps to keep your app secure.

More features: FrankenPHP offers several features that are not available in traditional PHP application servers, such as early hints and real-time capabilities.

Who should use FrankenPHP?

FrankenPHP is an excellent option for developers looking to enhance the performance, security, and simplicity of deploying their PHP applications. It is particularly well-suited for projects built with Symfony, Laravel, and WordPress.

Getting started with FrankenPHP

Starting with FrankenPHP is simple. Download the FrankenPHP binary from the website and follow the steps provided in the documentation. Additionally, there are numerous tutorials and blog posts available online to guide you through the process.

Conclusion

FrankenPHP is a robust and user-friendly application server designed for PHP. It enhances the performance, and security, and simplifies the deployment process of PHP applications. If you're seeking a cutting-edge solution to streamline your PHP development workflow, FrankenPHP is an excellent choice that offers both efficiency and modern features.

Additional resources

FrankenPHP website: https://frankenphp.dev/

FrankenPHP documentation: https://frankenphp.dev/docs/

FrankenPHP on GitHub: https://github.com/dunglas/frankenphp

CTI Threat Relationship Graph3 Knoten / 2 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - FrankenPHP: The Modern PHP App Server, written in Go
id: 8445961e-0b95-4fd5-9fcf-4555a311ff13
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "FrankenPHP: The Modern PHP App" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("FrankenPHP The Modern PHP App Server wri")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*FrankenPHP The Modern PHP App Server wri*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "FrankenPHP The Modern PHP App Server wri"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 6 Min

Salesforce unveils Agentforce to help create autonomous AI bots

IT Security Nachrichten

NÄCHSTER BEITRAG 1 Min

CVE-2014-6680 | superheroquiz 1.0 X.509 Certificate cryptographic issues (VU#582497)

Sicherheitslücken (CVE)Weiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich FrankenPHP: The Modern PHP App Server, w.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')