PHP2Shell and Azure DevOps: what to check

On October 21, 2026, PHP disclosed two critical vulnerabilities that can allow remote code execution.

Neither Azure DevOps Services, our cloud-hosted offering, nor Azure DevOps Server, our on-premises product, uses PHP to handle customer requests. PHP runtimes used by pipelines, containers, and deployed applications have their own patching requirements.

Deployment scope: cloud and on-premises

Azure DevOps Services (cloud). Microsoft operates and updates the service. You remain responsible for PHP installed by your pipeline steps or bundled into custom images and applications.

Azure DevOps Server (on-premises). You maintain the Server installation and its host. If that host also runs a separate PHP website or tool, update that PHP runtime through its vendor or package manager. A Server product update does not patch separately installed PHP.

PHP2Shell: exploitation mechanisms and remediation

CVE-2026-109618 concerns invalid request state following an out-of-memory failure. CVE-2026-109619 concerns stale request state consumed by a later request in the same persistent worker. Their exploit conditions differ; PHP CLI or Composer being installed is not, by itself, evidence of an exploitable HTTP path.

For this pair, the fixed upstream stable releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Applicable vendor-confirmed backports are also valid fixes.

Where should Azure Pipelines users look?

Agent hosting is a separate choice from the Services/Server deployment model.

• Microsoft-hosted agents (Services only). Microsoft is responsible for applying security updates to PHP preinstalled on its hosted VM images. Updates roll out by image, so availability can differ between images. If your PHP workload needs the fix before your selected image is updated, temporarily install a vendor-fixed PHP package in a setup step or use a patched job container. PHP installed by your own pipeline steps remains your responsibility. Jobs that do not run PHP need no PHP-specific change.
• Self-hosted agents (Services and Server). You maintain the agent host and its PHP installation. An Azure Pipelines agent upgrade updates the job-runner software; it does not replace PHP packages installed separately on that host or in job containers. Update host-installed PHP using your OS package manager or the PHP vendor’s supported process. For containerized PHP, rebuild the image and update the pipeline to use it. Restart PHP-serving processes after updating, according to vendor guidance.
• Containers and deployed applications. Job containers and deployed applications have their own runtime dependencies. Updating host packages does not update PHP bundled inside an image or application package.
• Tasks and integration backends. Extension tasks execute on agents, while integrations can use external services. Check relevant runtime dependencies with the publisher or operator.

Updating PHP used by your pipelines

For pipelines connected to either Services or Server, apply the fixes to PHP web servers started for tests and to PHP applications they deploy. These checks target PHP in your workloads, rather than Azure DevOps settings.

1. Check the runtime used by the job. Inspect PHP on the agent host or in the job container, including PHP installed by pipeline steps. Compare the full package revision and provenance with your vendor’s advisory, not php -v alone. For example, Ubuntu USN-8948-1 lists fixed revisions 8.3.6-0ubuntu0.24.04.13 for Ubuntu 24.04 and 8.5.4-0ubuntu1.5 for Ubuntu 26.04. Those upstream base versions alone do not identify patch status.
2. Patch environments and images you control. Update relevant PHP runtimes on self-hosted agents. Rebuild custom job or application images that bundle affected PHP, and update your pipeline or deployment to use the rebuilt image.
3. Verify the deployed application. Update its PHP runtime through the host or image owner, restart workers according to vendor guidance, and verify the running version after deployment.