vulnerable PHP

Question

vulnerable PHP

Patti Sullivan 0

i am a small business and was told I need azure help to assist me with fixing a vulnerable PHP. what plan should I purchase?

0 comments

1 answer

Your answer

Answer 1

Purchase Azure Standard Support only if the vulnerable PHP application is a production workload hosted on Azure; otherwise, an Azure support plan is unlikely to provide the remediation you need. Standard is intended for small or midsize organizations with production workloads and costs $100/month. It provides online technical support, including Severity A–C cases and 24x7 access for higher-severity incidents. ^1^

Before purchasing

Confirm where PHP is running:

Azure App Service: Standard Support is the appropriate entry-level production support plan.
Azure virtual machine: Standard Support can help diagnose the Azure platform, but updating PHP and repairing the application may remain your responsibility.
A website hosted outside Azure: Do not purchase an Azure plan solely for this issue. Contact the hosting provider or hire a PHP/WordPress developer or security specialist.
Development or test system only: Developer Support costs $29/month, but it handles only Severity C issues during business hours and is intended for non-production use. ^2^

Paid plans cover technical break-fix issues for supported Azure services. However, they should not be treated as a managed website-maintenance service: advisory, escalation, and account-management services require higher plans, and support for non-Microsoft technology depends on how it is supplied through Azure. ^3^

Before paying, create the support request in Azure portal → Help + support → Create a support request and proceed until the portal displays the available plan and scope for that subscription. If the site is managed by a Cloud Solution Provider, ask the provider whether support must be opened through them.

If this is Azure App Service

The likely remediation is to move the application to a currently supported PHP runtime, not merely buy support. Microsoft recommends using the latest PHP version to receive security fixes. ^4^

In the Azure portal, open App Services → your app → Stack settings.
Record the current PHP version.
Check that the application, themes, plug-ins, and Composer packages support the target version.
Test the upgrade in a staging slot or non-production copy.
Select a supported PHP version, save, restart the app, and test it before moving production traffic.

For a Linux App Service, the current and available runtimes can also be checked in Cloud Shell:

az webapp config show \
  --resource-group <resource-group> \
  --name <app-name> \
  --query linuxFxVersion

az webapp list-runtimes --os linux | grep PHP

Do not copy the documentation’s PHP 8.1 example as the upgrade target; choose a version currently returned by the runtime-list command and supported by the application. PHP is supported on App Service Linux only; PHP on App Service Windows reached end of support in November 2022. ^5^

App Service automatically applies PHP patch-version updates to its built-in runtime, while major or minor upgrades must be selected manually. Custom runtimes or container images must be updated by the application owner. ^6^

If the reported vulnerability is in your PHP code, WordPress plug-ins, themes, or Composer packages rather than the Azure-provided runtime, engage the application vendor or a qualified developer as well. Standard Support can investigate the Azure service, but the available support scope does not establish that Microsoft will rewrite or remediate third-party application code.

Recommendation

Production site on Azure: Purchase Standard.
Non-production Azure site: Consider Developer.
Site not hosted on Azure, or vulnerability is in custom code/plugins: Use the hosting provider or a PHP security professional instead.
Do not purchase ProDirect solely for this repair: It is aimed at organizations with substantial business-critical Azure use; Standard is the closer fit for a small production environment.

References