Critical PHP Security Release: What It Means for Azure App Service

3 minute read • By Tulika Chaudharie, Byron Tardif, Andrew Westgarth • October 21, 2026

PHP on App Service Windows: The built-in PHP runtimes on App Service for Windows are end-of-life (EOL). No security patch for these runtimes is currently planned.

  1. Move to App Service on Linux if possible. Update and test your app on a supported PHP version to receive the patched built-in PHP runtime.
  2. If you must remain on Windows, bring your own PHP runtime. Follow How to use a Custom PHP runtime for App Service Windows and use a supported PHP version that includes the security fixes. You are responsible for deploying, configuring, and maintaining that runtime, including applying future security patches.

Azure Stack Hub: This Windows guidance also applies to PHP apps running on Azure App Service on Azure Stack Hub.

PHP on Azure App Service on Azure Stack Hub: The above guidance re PHP on App Service Windows also applies for App Service on Azure Stack Hub, as the Resource Provider only support Windows Code hosting.

WordPress update (21 October 2026): WordPress apps deployed using the official WordPress on App Service offering in Microsoft Marketplace have been updated to patched PHP versions, except for apps still using the older Alpine-based images. The older Alpine-based images will not receive these security patches. If your app uses an Alpine-based image, follow Transition from Alpine Linux to Debian for WordPress on App Service to migrate to a Debian-based image.

Update (21 October 2026): We have completed the rollout of the updated built-in PHP images with the security fixes to both the Latest and Standard Platform Release Channels for Azure App Service on Linux.

The updated PHP runtime versions are:

PHP runtime Updated version
PHP 8.2 8.2.35
PHP 8.3 8.3.36
PHP 8.4 8.4.27
PHP 8.5 8.5.12

End-of-life (EOL) PHP versions will not receive these security patches. If your app uses an EOL PHP version, update your app to a supported PHP version. Changing your Platform Release Channel does not upgrade an EOL runtime to a supported version.

The PHP security team’s announcement covers two critical vulnerabilities, both rated CVSS v4.0 9.2 (Critical).

The release date is Wednesday, 21 October 2026 at 14:00 UTC. The PHP security team publishes full details, affected versions, and fixed versions with the release.

What we are doing

The Azure App Service team is actively updating the built-in PHP images for App Service on Linux with the fixed PHP versions.

Updated images roll out through the Platform Release Channels as follows:

Channel Availability of the fix
Latest Receives the fix at priority.
Standard (default) Receives the fix through an accelerated Safe Deployment Practices (SDP) rollout.
Extended Follows Standard and receives the fix last.

What you should do

We encourage all PHP customers on App Service for Linux to act now to pick up the fix as it becomes available.

  1. Move away from the Extended channel. Extended typically stays one release behind Standard, so it receives this fix last. To avoid prolonged exposure, switch to Standard or Latest now.
  2. Choose Latest if you need the fix fastest. Internet-facing or high-risk PHP apps should consider the Latest channel to get the updated images at priority.
  3. Update your custom containers yourself. If you run PHP in a custom container, or bring your own PHP runtime, App Service does not patch it. Rebuild your images with the fixed PHP versions published by the PHP team.
  4. Verify your PHP version. Open an SSH session to your app (https://<appname>.scm.azurewebsites.net/webssh/host) and run php --version.
  5. Upgrade EOL PHP runtimes. Apps running an end-of-life PHP version will not receive these security patches. Update and test your app on a supported PHP version, then configure your app to use that version.

Change your Platform Release Channel

  1. In the Azure portal, go to your App Service app.
  2. In the left menu, select Stack settings.
  3. Under Platform Release Channel, select Latest or Standard.
  4. Select Save.

For more information, see OS and runtime patching in Azure App Service.

Stay informed

We share updates here as the PHP team publishes fixed versions and updated images become available.

Thank you for helping us keep your PHP apps on Azure App Service secure.

You may also enjoy

Azure Functions: .NET Brotli Security Updates

4 minute read • By Byron Tardif • October 26, 2026

Update (27 October 2026): The platform-managed .NET security update rollout is complete for Linux Azure Functions, Azure Static Web Apps managed functions...

Time Zone Updates on Azure App Service for Windows

2 minute read • By Byron Tardif • October 23, 2026

Update (26 October 2026): The rollout of Windows operating-system time-zone updates on Azure App Service for Windows is complete, following accelerated Sa...