Check ID:
Provider: Azure
Service:
Severity: LOW
Categories:
Resource type:
app_ensure_php_version_is_latestProvider: Azure
Service:
appSeverity: LOW
Categories:
vulnerabilitiesResource type:
microsoft.web/sitesWhat this check verifies
Azure App Service web apps running PHP are evaluated to ensure the runtime is configured to the latest supported release. The finding compares the app’s PHP stack (fromlinuxFxVersion or php_version) with the newest available version.
Risk
Using outdated PHP enables exploitation of known flaws, including remote code execution, causing secret disclosure (confidentiality), unauthorized changes (integrity), and crashes or downtime (availability). Deprecated versions lack patches, widening exposure and instability.Recommendation
Standardize on the latest supported PHP and avoid EoL releases. Update promptly after security advisories, validate in staging, and automate version governance across apps. Prefer supported Linux runtimes, limit optional extensions, and apply defense in depth and least privilege to reduce blast radius.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az webapp config set —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —linux-fx-version “PHP|8.2”
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/AppService/latest-version-of-php.html
- https://learn.microsoft.com/en-us/azure/app-service/configure-language-php?pivots=platform-linux#set-php-version
- https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#general-settings
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_ensure_php_version_is_latest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks