PHP2Shell and Azure DevOps: what Pipelines users should check

PHP disclosed two critical vulnerabilities on October 21, 2026 that can allow remote code execution. Azure DevOps Services and Server do not use PHP for customer requests, so the exposure sits in the PHP runtimes your pipelines, agents, containers and deployed apps use. The post explains which PHP installs Microsoft patches and which ones you must patch.

Key points

• Confirm PHP is at 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-confirmed backport of those fixes.
• On Microsoft-hosted agents, if the image is not yet updated, install a fixed PHP package in a setup step.
• On self-hosted agents, update PHP through the OS package manager; an agent upgrade does not touch it.
• Rebuild job container images that bundle PHP and point your pipeline at the new image.
• Verify the PHP version of deployed apps after rollout and restart PHP workers as the vendor advises.
• Compare full package revisions against the vendor advisory instead of trusting php -v alone.

PHP disclosed two critical vulnerabilities on October 21, 2026 that can allow remote code execution, a pair now referred to as PHP2Shell. Azure DevOps Services and Azure DevOps Server do not use PHP to handle customer requests, so the exposure lies in the PHP runtimes used by your pipelines, agents, job containers and deployed applications. The fixed upstream stable releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and vendor-confirmed backports count as fixes too.

Who patches what depends on the agent. Microsoft updates PHP preinstalled on Microsoft-hosted images, rolled out image by image, so a setup step can install a fixed package in the meantime. Self-hosted agents, job containers and any PHP on an Azure DevOps Server host remain your responsibility, and an agent upgrade does not replace separately installed PHP. Compare full package revisions with your vendor advisory rather than relying on php -v alone.

Real-world use

• A team running PHP web server tests on a self-hosted Azure Pipelines agent.
• A deployment pipeline that ships a PHP application inside a custom job or app container image.
• An on-premises Azure DevOps Server host that also runs a separate PHP tool and needs its own patch check.

Why it matters

Azure DevOps itself is not exposed, but any PHP your pipelines run stays your patching job. Knowing which agent or image you own tells you where the fix must land and how fast.

Related stories

• Publish Visual Studio Marketplace extensions securely with Trusted PublishingMDMicrosoft for Developers Blog5 d ago
• Avalonia security incident: CMS breach, packages and customer data unaffectedAVAvalonia UI BlogOct 23
• Mastering Rate Limiting and Resource Governance for MCP Servers at ScaleDVDEV Community: #aspnetcore1 d ago