When will PHP 8.4.27 (fix for CVE-2026-109618 / CVE-2026-109619) be rolled out to App Service on Linux?

Question

When will PHP 8.4.27 (fix for CVE-2026-109618 / CVE-2026-109619) be rolled out to App Service on Linux?

Tristan Marzec 25

Hi,

we are running several WordPress sites on Azure App Service for Linux using the built-in PHP stack (publishing model "Code", runtime stack "PHP 8.4").

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 ("php2shell", CVSS v4.0 9.2, unauthenticated remote code execution). The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Reference: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

Our apps are still running PHP 8.4.26 (verified via SSH with "php -v"), so they are currently vulnerable.

We are aware that App Service updates the PHP runtime automatically as part of regular platform updates. Given the severity and reports of active exploitation, we would like to know:

Is there an estimated timeline for rolling out the patched PHP versions (especially 8.4.27) to App Service on Linux?
Will the update be rolled out as an expedited security update, or with the regular platform update cadence?
Will the patched images be available earlier in the "Latest" update channel than in the "Standard" channel?
Does Microsoft recommend any interim mitigation for apps on the built-in PHP stack until the rollout is complete?
Is there an official place (e.g. Azure Service Health, App Service blog) where the rollout status will be announced?

Thanks in advance!

PAVAN KUMAR GADDE 0 Reputation points Microsoft External Staff

2026-10-21T16:14:51.4733333+00:00
Hi @Tristan Marzec

The patched PHP images for App Service on Linux are already out. The App Service team rolled updated built-in PHP and WordPress images to all regions on October 21, 2026, the same day PHP published the fixes for CVE-2026-109618 and CVE-2026-109619.

To confirm your app is on the patched version:

Check what's actually running. Open SSH (Development Tools → SSH) and run php --version. ✔ To verify: PHP 8.4 apps should show 8.4.27 or later. If you see an older 8.4.x, continue to step 2.

Check your runtime setting. Run az webapp config show -g <rg> -n <app> --query linuxFxVersion. It should be PHP|8.4, not a full image tag such as 8.4-fpm_2025…. Pinned tags don't receive the update. ✔ To verify: after you correct it and restart, step 1 shows the new version.

Check your release channel and image type. If the app is on Standard or Extended, switch to Latest to pick up the fix right away. If you set WEBSITES_DISABLE_FPM, you're on the legacy Apache image, which no longer gets security updates. Move to the default Nginx/FPM image instead. ✔ To verify: php --version again after the restart.

Apps on PHP 8.1 or older won't get a fix from PHP itself, so upgrade them to 8.2 or later. Custom containers need to be rebuilt on a patched base image (php 8.4.27 or later).

Reference link: Critical PHP Security Release: What It Means for Azure App Service - Azure App Service

2 answers

Your answer

PAVAN KUMAR GADDE 0 Reputation points Microsoft External Staff

2026-10-21T16:14:51.4733333+00:00

Hi @Tristan Marzec

The patched PHP images for App Service on Linux are already out. The App Service team rolled updated built-in PHP and WordPress images to all regions on October 21, 2026, the same day PHP published the fixes for CVE-2026-109618 and CVE-2026-109619.

To confirm your app is on the patched version:

Check what's actually running. Open SSH (Development Tools → SSH) and run php --version. ✔ To verify: PHP 8.4 apps should show 8.4.27 or later. If you see an older 8.4.x, continue to step 2.

Check your runtime setting. Run az webapp config show -g <rg> -n <app> --query linuxFxVersion. It should be PHP|8.4, not a full image tag such as 8.4-fpm_2025…. Pinned tags don't receive the update. ✔ To verify: after you correct it and restart, step 1 shows the new version.

Check your release channel and image type. If the app is on Standard or Extended, switch to Latest to pick up the fix right away. If you set WEBSITES_DISABLE_FPM, you're on the legacy Apache image, which no longer gets security updates. Move to the default Nginx/FPM image instead. ✔ To verify: php --version again after the restart.

Apps on PHP 8.1 or older won't get a fix from PHP itself, so upgrade them to 8.2 or later. Custom containers need to be rebuilt on a patched base image (php 8.4.27 or later).

Reference link: Critical PHP Security Release: What It Means for Azure App Service - Azure App Service

Answer 1

Hi Tristan Marzec & thx for join me at Q&A platform,

actually an update about these two PHP vulnerabilities on the official Azure App Service team blog, dated October 21, 2026. https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html

The good news is that the App Service team has confirmed they're actively updating the built-in PHP images, and this is being handled as an expedited security rollout rather than waiting for the normal update cycle.

According to Microsoft's announcement, the Latest platform release channel receives the patched images first. Standard follows through an accelerated Safe Deployment Practices rollout, while Extended receives the updates last.

So for ur internet-facing WordPress sites, I'd recommend switching to Latest now. In the Azure portal, open ur App Service, go to Stack settings > Platform Release Channel, select Latest, and save. Just keep in mind that switching channels doesn't guarantee PHP 8.4.27 is already available in ur region.

Microsoft hasn't provided a specific completion date or region-by-region rollout schedule in that announcement, so I wouldn't assume every App Service instance will receive the fix at the same time.

After switching, check the actual PHP version through SSH using php -v. Don't rely only on the configured PHP 8.4 runtime stack, bc that doesn't tell u which patch release is currently running.

Regarding interim mitigation, there's no complete workaround for these vulnerabilities other than running a patched PHP version. WAF rules and access restrictions may reduce exposure, but they shouldn't be treated as equivalent to patching. If Latest still serves PHP 8.4.26 and the exposure is unacceptable, moving to a separately maintained container with PHP 8.4.27 is an option, tho that requires changing ur deployment model and taking responsibility for subsequent updates.

For rollout announcements, I'd follow the official Azure App Service team blog, which specifically says updates will be shared there as patched images become available.

Given the severity, I'd also open an Azure support case if ur production apps remain on PHP 8.4.26 after switching to Latest. Include the region, App Service resource IDs, release channel, and actual PHP version, and ask whether the patched runtime image has reached ur deployment stamp.

The key point is that Microsoft has confirmed an accelerated rollout and the channel priority, but hasn't committed to an exact availability time for PHP 8.4.27 in every region yet.

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer

Answer 2

Christiansen, Karsten 0

We had to change our configuration stack from Standard to Latest for it to update because apparently standard doesn't actually mean anything for updating.

0 comments