PHP2Shell in Azure App Service (PHP): is it affected and how to fix it

How to check the PHP version Azure App Service (PHP) uses

Run the command for your setup. A version at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in its branch is fixed; older branches are fixed only by a vendor build that says so.

php --version
echo $PHP_VERSION

Run these in the app's SSH console (Kudu WebSSH at https://<app-name>.scm.azurewebsites.net/webssh/host). In the portal, Stack settings shows the PHP major.minor and the Platform Release Channel.

The command-line php can differ from the PHP that serves the site. To be sure, check the web SAPI (a temporary phpinfo() page behind authentication, or the panel's PHP settings) and remove it afterwards. Our version checker compares a version number for you.

🔎 Got a version number? Paste it into the PHP2Shell checker →

How to fix PHP2Shell in Azure App Service (PHP)

1. If the app is on the Extended Platform Release Channel, switch it to Standard or Latest (portal → your app → Stack settings → Platform Release Channel → Save). Microsoft suggests Latest for internet-facing or high-risk apps.
2. Confirm the running version over SSH is 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later; restart the app if it still reports the old one.
3. Custom container or your own PHP build: rebuild the image on a fixed PHP release and redeploy. Azure does not patch it for you.
4. PHP 8.1 or older: changing the channel does not help. Move the app to a supported PHP version and test it.
5. WordPress on App Service on an Alpine image: migrate to the Debian-based image.
6. Install the vendor's fixed release or packages listed above.
7. Restart every PHP process (PHP-FPM pools, Apache with mod_php, LiteSpeed lsphp, queue workers); a running process keeps the old PHP in memory.
8. Confirm the running version again with the check commands.

Prefer to let an AI agent do the checks? Check if you are affected · Fix with an AI agent

If you cannot patch yet

• Set session.upload_progress.enabled = 0 where applications cannot override it (php.ini, php_admin_value in the FPM pool or Apache config), and restart PHP.
• On PHP 8.5, set fatal_error_backtraces = 0.
• PHP's interim advice also covers memory_limit and a low post_max_size; follow the remediation page exactly, because these settings only reduce some paths.
• Restrict access (VPN, IP allowlist) or take the service offline if it runs PHP 8.1 or older with no vendor backport. WAF rules help but are not a fix.

FAQ

Related products

• Laravel ForgePatch your OS / host PHP
• RunCloudNo vendor advisory
• ServerPilotNo vendor advisory
• AWS: Amazon Linux, Elastic Beanstalk, LightsailPartly fixed

← All products that bundle PHP

See also: Remediation by platform · Affected versions · Vendor status

Unofficial summary of public sources. This site is not affiliated with the vendor or the PHP project and hosts no exploit code.