PHP2Shell and Azure DevOps: what to check
Azure DevOps Services and Server are not affected by the PHP vulnerabilities, but pipelines, containers, and deployed applications may require separate patching.
What you should do
Review and update the security settings for pipelines, containers, and deployed applications to ensure they are patched against the PHP vulnerabilities. AI-suggested
Why: This change may need administrator attention depending on how your environment is configured.
Details
Original Microsoft text
On October 21, 2026, PHP disclosed two critical vulnerabilities that can allow remote code execution. Neither Azure DevOps Services, our cloud-hosted offering, nor Azure DevOps Server, our on-premises product, uses PHP to handle customer requests. PHP runtimes used by pipelines, containers, and deployed applications have their own patching requirements. Deployment scope: cloud and on-premises Azure […] The post PHP2Shell and Azure DevOps: what to check appeared first on Azure DevOps Blog.
- Type
- Announcements
- Tags
- Azure DevOps Blog, Azure & Cloud, Azure DevOps, Azure DevOps Server, Security, Azure Pipelines, Microsoft-hosted agents, PHP, PHP2Shell
- AI analysis
- Medium priority · generated by qwen2.5:7b · verify against the original