Microsoft Azure App Service and PHP2Shell

Is this your company?

Publish or update your statement. The statement submission is free.

See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.

We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.

Agencies: white-label PHP2Shell Record Check, $490 per client report.

The statement

We have completed the rollout of the updated built-in PHP images with the security fixes.

Notes

We have completed the rollout of the updated built-in PHP images with the security fixes. (Latest and Standard Platform Release Channels) and If you run PHP in a custom container, or bring your own PHP runtime, App Service does not patch it. quoted from https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html (Azure App Service team blog; authors Tulika Chaudharie, Byron Tardif; title: Critical PHP Security Release: What It Means for Azure App Service on Linux). Customers on the Extended channel told to move off it; End-of-life (EOL) PHP versions will not receive these security patches.; WordPress on App Service updated except older Alpine-based images: The older Alpine-based images will not receive these security patches. A second Microsoft post exists at techcommunity.microsoft.com (Azure Network Security Blog, modified 2026-10-22T10:26:20-07:00, title: Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations) whose body did not render in fetch.

Change log

• 23 October 2026: first check
• 23 October 2026: Published statement excerpt reverified; classification unchanged.

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

The badge for Microsoft Azure App Service reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.

Questions about Microsoft Azure App Service and PHP2Shell

Is Microsoft Azure App Service affected by PHP2Shell?

Microsoft Azure App Service's PHP2Shell statement is recorded as patched partly, with statement date printed as October 21, 2026; source: https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html.

The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.