Check ID: app_ensure_php_version_is_latest
Provider: Azure
Service: app
Severity: LOW
Categories: vulnerabilities
Resource type: microsoft.web/sites

What this check verifies

Azure App Service web apps running PHP are evaluated to ensure the runtime is configured to the latest supported release. The finding compares the app’s PHP stack (from linuxFxVersion or php_version) with the newest available version.

Risk

Using outdated PHP enables exploitation of known flaws, including remote code execution, causing secret disclosure (confidentiality), unauthorized changes (integrity), and crashes or downtime (availability). Deprecated versions lack patches, widening exposure and instability.

Recommendation

Standardize on the latest supported PHP and avoid EoL releases. Update promptly after security advisories, validate in staging, and automate version governance across apps. Prefer supported Linux runtimes, limit optional extensions, and apply defense in depth and least privilege to reduce blast radius.

Remediation

az webapp config set —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —linux-fx-version “PHP|8.2”

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_ensure_php_version_is_latest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks