eMudhra / emSign Certificate Security Updates on Azure App Service for Linux
Update (25 October 2026): The Java rollout is now complete on Standard. Rollout of patched built-in Linux images for the eMudhra / emSign CA certificate security incident is complete on Latest and Standard for all runtimes listed below, including Java. No channel change is needed. The PHP 8.2 and EOL exclusions described below remain unchanged.
The eMudhra / emSign incident affects certificate trust used by TLS clients. The Ubuntu Security Team’s incident and patch guidance explains the CA trust-store changes needed to mitigate the risk of man-in-the-middle attacks.
This is not limited to a single language runtime. Applications can use operating-system certificates, runtime-managed trust stores, or certificate bundles supplied by dependencies. Updating the platform image does not replace certificate bundles managed by your application.
What we are doing
Patched built-in Linux images are available on Latest and Standard for all non-EOL runtimes, with the PHP 8.2 exception described below. Java is available on both Latest and Standard; its rollout is complete.
The following runtime versions are listed by az webapp list-runtimes -o table --os linux as of 22 October 2026 and are included in the completed rollout to Latest and Standard. For Java, the table summarizes Java SE versions rather than listing individual application-server combinations.
| Runtime | Versions included in the image updates |
|---|---|
| .NET | 8, 9, 10, 11 |
| Node.js | 22, 24 |
| Python | 3.10, 3.11, 3.12, 3.13, 3.14 |
| PHP | 8.3, 8.4, 8.5 |
| Java SE | 8, 11, 17, 21, 25 |
Runtimes approaching EOL are included while they remain supported. EOL runtimes do not receive these image updates.
WordPress on App Service is also updated. The supported images for apps deployed using the official WordPress on App Service offering in Microsoft Marketplace include the certificate security updates.
PHP 8.2 exception
The built-in PHP 8.2 image is not included in this initial patch payload. Although PHP 8.2 itself has not yet reached EOL, its underlying Debian 11 (Bullseye) operating system is beyond Debian’s standard/LTS support period and is not providing the patch for this image.
We are investigating options to provide a patch for PHP 8.2. No availability date is confirmed.
If your app uses PHP 8.2, update and test your app on PHP 8.3 or a later supported version, then configure your app to use that runtime. Moving a PHP 8.2 app to Latest alone does not address this exception.
Rollout by Platform Release Channel
| Channel | Availability of the updates |
|---|---|
| Latest | Rollout complete. |
| Standard (default) | Rollout complete for the included runtimes, including Java. |
The updated images are available on both Latest and Standard for all included runtimes, including Java.
Changing your Platform Release Channel does not upgrade your app to a different runtime version or make an EOL runtime supported.
What you should do
- Use Standard or Latest to receive these updates. For eligible runtimes, including Java, apps on either channel do not need a channel change.
- Upgrade PHP 8.2 and EOL runtimes. PHP 8.2 is excluded from this certificate patch because of its OS base. EOL runtimes are also excluded. Update and test your app on a supported runtime included in the patching scope.
- Update application-managed certificate bundles and dependencies. Review the official guidance for your runtime and libraries. An updated platform trust store does not necessarily update a library’s bundled certificates or an existing virtual environment.
- Update custom containers and bring-your-own runtimes yourself. App Service does not patch the contents of your custom images or runtimes. Update their OS packages, runtimes, and affected dependencies, then rebuild, test, and redeploy.
- Test outbound TLS connections. Check the services your app calls after updating. Do not work around certificate errors by disabling TLS certificate validation.
- Check the running image’s certificate package. Use the instructions below to inspect the OS certificate package. This check does not verify application-managed trust stores.
Change your Platform Release Channel
Azure portal
- In the Azure portal, go to your App Service app.
- In the left menu, select Stack settings.
- Under Platform Release Channel, select Standard.
- Select Save.
Azure CLI
Use az webapp update to move your app to Standard:
az webapp update \
--resource-group <resource-group> \
--name <app-name> \
--platform-release-channel Standard
Replace the placeholders with your app’s resource group and name. For a deployment slot, add --slot <slot-name>.
Eligible apps, including Java apps, already on Standard or Latest do not need a channel change.
Verify the certificate package
Use az webapp exec (currently in preview) with Azure CLI 2.90.0 or later to open an interactive shell in your running app:
az webapp exec --resource-group <resource-group> --name <app-name>
Replace the placeholders with your app’s resource group and name. For a deployment slot, add --slot <slot-name>.
Inside the container, identify the OS and installed certificate-package version:
cat /etc/os-release
dpkg-query -W -f='${Package} ${Version}\n' ca-certificates
For Ubuntu-based images, compare the installed version with the fixed version for the same Ubuntu release in the Ubuntu incident and patch guidance. For example:
| Ubuntu release | Fixed ca-certificates version |
|---|---|
| 24.04 | 20260816ubuntu0.24.04.1 |
| 26.04 | 20260816ubuntu0.26.04.1 |
The listed version or a subsequent version containing the fix is the expected result. Do not compare package versions across different OS releases. For Debian-based images, use the corresponding Debian package guidance rather than the Ubuntu versions.
This check inspects the OS certificate package on one running instance, not every trust store used by your app. Use --instance <instance-id> to connect to other instances as needed. Application-managed CA bundles and runtime-specific trust stores require separate checks. A successful HTTPS request alone is not proof that the issue is mitigated.
Application-managed trust stores and dependencies
The platform update covers the built-in images, not certificate bundles or trust stores that your app supplies. Review your app’s libraries, dependencies, and custom trust-store configuration, and follow their maintainers’ incident guidance. Update affected dependencies through your trusted package source, then rebuild, test, and redeploy as needed.
As the Ubuntu guidance notes, removing affected trust anchors can also cause connections to legitimate endpoints that rely on those anchors to fail. Test outbound TLS connections and work with the endpoint owner to resolve affected certificate chains rather than disabling certificate validation.
Related updates
- eMudhra / emSign certificate security updates on App Service for Windows covers the separate Windows OS certificate rollout. Linux Platform Release Channel settings do not apply to Windows.
- Time zone updates on App Service for Linux covers the separate time-zone data rollout, whose PHP 8.2 and 8.3 exclusions differ from the certificate update exclusion described here.
- Critical PHP security release guidance for App Service covers the separate PHP runtime vulnerabilities and rollout.
- Node.js and Python emergency runtime updates on App Service for Linux covers the runtime releases and their rollout. Review that guidance alongside the certificate updates here; runtime patches do not replace application-managed CA bundles.
Stay informed
We share further updates here as needed, including any changes to the PHP 8.2 patch plan.
Thank you for helping us keep your apps on Azure App Service secure.
