Critical PHP Security Release: What It Means for Azure App Service on Linux

WordPress update (21 October 2026): WordPress apps deployed using the official WordPress on App Service offering in Microsoft Marketplace have been updated to patched PHP versions, except for apps still using the older Alpine-based images. The older Alpine-based images will not receive these security patches. If your app uses an Alpine-based image, follow Transition from Alpine Linux to Debian for WordPress on App Service to migrate to a Debian-based image.

---

Update (21 October 2026): We have completed the rollout of the updated built-in PHP images with the security fixes to both the Latest and Standard Platform Release Channels for Azure App Service on Linux.

The updated PHP runtime versions are:

PHP runtime	Updated version
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12

End-of-life (EOL) PHP versions will not receive these security patches. If your app uses an EOL PHP version, update your app to a supported PHP version. Changing your Platform Release Channel does not upgrade an EOL runtime to a supported version.

The PHP security team’s announcement covers two critical vulnerabilities, both rated CVSS v4.0 9.2 (Critical).

The release date is Wednesday, 21 October 2026 at 14:00 UTC. The PHP security team publishes full details, affected versions, and fixed versions with the release.

• Official announcement: php.net news, 20 Oct 2026
• Mailing list: php.announce #509: Upcoming Critical PHP Security Release

What we are doing

The Azure App Service team is actively updating the built-in PHP images for App Service on Linux with the fixed PHP versions.

Updated images roll out through the Platform Release Channels as follows:

Channel	Availability of the fix
Latest	Receives the fix at priority.
Standard (default)	Receives the fix through an accelerated Safe Deployment Practices (SDP) rollout.
Extended	Follows Standard and receives the fix last.

What you should do

We encourage all PHP customers on App Service for Linux to act now to pick up the fix as it becomes available.

1. Move away from the Extended channel. Extended typically stays one release behind Standard, so it receives this fix last. To avoid prolonged exposure, switch to Standard or Latest now.
2. Choose Latest if you need the fix fastest. Internet-facing or high-risk PHP apps should consider the Latest channel to get the updated images at priority.
3. Update your custom containers yourself. If you run PHP in a custom container, or bring your own PHP runtime, App Service does not patch it. Rebuild your images with the fixed PHP versions published by the PHP team.
4. Verify your PHP version. Open an SSH session to your app (https://<appname>.scm.azurewebsites.net/webssh/host) and run php --version.
5. Upgrade EOL PHP runtimes. Apps running an end-of-life PHP version will not receive these security patches. Update and test your app on a supported PHP version, then configure your app to use that version.

Change your Platform Release Channel

1. In the Azure portal, go to your App Service app.
2. In the left menu, select Stack settings.
3. Under Platform Release Channel, select Latest or Standard.
4. Select Save.

For more information, see OS and runtime patching in Azure App Service.

Stay informed

We share updates here as the PHP team publishes fixed versions and updated images become available.

Thank you for helping us keep your PHP apps on Azure App Service secure.