Commit

🔒 Arco v0.10.1: security release, update now PHP 8.5.12 fixes two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that allow unauthenticated remote code execution. php.net lists FrankenPHP as affected, and one of the bugs targets long-lived workers, the exact model Octane uses. New to Arco? It’s an open-source CLI that deploys Laravel to AWS Lambda Web Functions using FrankenPHP and Octane workers. No servers, one command: arco deploy. What 0.10.1 does: ⚡ The default runtime is now PHP 8.5.12 + FrankenPHP 1.13.1. The binary’s GitHub attestation and checksums were verified before it was published. 🛡️ php.net’s interim hardening is on by default for web, console and queue workers (session.upload_progress.enabled=0, fatal_error_backtraces=0). You can still override either setting with phpIni(). To update: composer update multiapi/arco multiapi/arco-laravel vendor/bin/arco deploy Each environment keeps its old binary until you deploy again, so redeploy every environment. If you pinned a runtime build(), remove the pin or move it to the new build.