Azure AppService CVE-2026-109619 CVE-2026-109618

Mateusz Juras 0 Reputation points
2026-10-21T16:23:17.6633333+00:00

Could you provide me an information when AppService Runtime Stack with PHP 8.3+ will be updated to PHP 8.3.35?

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andriy Bilous 12,596 Reputation points MVP
    2026-10-22T04:13:59.6566667+00:00

    Hello Mateusz Juras

    The Azure App Service team has confirmed that the security update for CVE-2026-109618 and CVE-2026-109619 was fully rolled out on October 21, 2026, to both the Latest and Standard Platform Release Channels for App Service on Linux.

    The patched PHP versions are:

    • PHP 8.3 → 8.3.36 (not 8.3.35)
    • PHP 8.4 → 8.4.27
    • PHP 8.5 → 8.5.12

    To verify your application:

    1. In Azure Portal, open App Service → Stack settings → Platform Release Channel and ensure you're using Standard or Latest, not Extended.
    2. Open the application's SSH console and run php --version.
    3. If you're using a custom PHP container, rebuild and redeploy it with the patched PHP version. Microsoft does not update custom images automatically.

    If your app still runs a vulnerable PHP version on Standard or Latest, open an Azure Support request with the App Service name, region, release channel, and PHP version output.

    Official Microsoft announcement (updated October 21, 2026):

    https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html

    Microsoft runtime patching documentation:

    https://learn.microsoft.com/en-us/azure/app-service/overview-patch-os-runtime

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.