External risk intelligence

FrankenPHP Docker Image Security Update Required

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-128027

FrankenPHP is a modern application server designed to host and serve web applications and APIs. By its nature, it is intended to be internet-facing to handle incoming HTTP/HTTPS traffic. Because the vulnerability exists within the container images used for these web-facing services, it is highly probable that affected deployments are exposed to the public internet in common usage.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in FrankenPHP Docker images where security updates to underlying system libraries were not consistently applied, potentially allowing remote attackers to execute code by exploiting known flaws in outdated components. The main concern is confirming relevance and exposure.

Stale software in container images allows code execution.
Outdated library flaws could be exploited remotely.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

Attackers could exploit outdated security fixes within FrankenPHP Docker images by targeting unpatched system libraries. This occurs because the images were not always rebuilt when base image security updates were released, leaving known vulnerabilities accessible. If successful, this could allow remote attackers to execute arbitrary code.

Vulnerable Docker images may contain unpatched libraries.
Known flaws in system libraries can be triggered remotely.
Risk of remote code execution exists.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, remote attackers could exploit known flaws in stale system libraries within certain FrankenPHP Docker images to execute code. This could occur if the base image had not been updated to include security fixes from Alpine, PHP, or Go.

System libraries could be affected.
Known flaws in stale libraries may be exploited.
Code execution is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The discovery of vulnerabilities in FrankenPHP Docker images prior to version 1.1.11 indicates a need for immediate attention from platform and infrastructure teams. These images failed to propagate security fixes from base image updates, leaving systems vulnerable to remote code execution via exploited libraries. The initial action should be to identify all deployments of these affected Docker images, assess their exposure and criticality, and then coordinate remediation with the accountable owners, potentially involving vendor management if using a managed service.

Platform and infrastructure teams own remediation.
Verify all FrankenPHP Docker image deployments.
Plan for container image updates and redeployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FrankenPHP?

FrankenPHP is a modern application server designed to host web applications and APIs. It is built as a containerized environment that integrates PHP with a high-performance Go-based web server. Developers use it to serve incoming HTTP/HTTPS traffic efficiently, acting as the primary interface between the public web and the application code running inside the container.

What does CVE-2026-128027 mean for my software?

This vulnerability is a software supply chain issue where FrankenPHP Docker images failed to automatically incorporate security patches from their underlying base layers—specifically Alpine, PHP, and Go. Because the images were not rebuilt when those base components received updates, your application may be running on outdated system libraries that contain known, exploitable flaws.

How do attackers trigger this vulnerability?

An attacker triggers this by targeting known vulnerabilities present in the stale system libraries within an unpatched FrankenPHP container. This is not triggered by the application code itself, but by flaws inherent in the underlying OS or runtime libraries that were left unpatched. If an attacker identifies a known exploit for a library version contained in your image, they may be able to execute arbitrary code remotely.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because FrankenPHP is designed to host web services, it is typically deployed in internet-facing configurations. Since the vulnerability resides within the container image that handles this traffic, there is a high probability that affected deployments are accessible to the public internet, increasing the relevance of this risk for your infrastructure.

What steps should I take to fix this?

You should immediately identify all systems running FrankenPHP versions earlier than 1.1.11. The primary response is to update your FrankenPHP Docker images to version 1.1.11 or later, which ensures all security fixes from the base image layers are properly propagated. After updating, redeploy your containers and verify that the underlying system libraries are current.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.