DO Azure DevOps Blog
Blog

PHP2Shell and Azure DevOps: what Pipelines users should check

PHP disclosed two critical vulnerabilities on October 21, 2026 that can allow remote code execution. Azure DevOps Services and Server do not use PHP for customer requests, so the exposure sits in the PHP runtimes your pipelines, agents, containers and deployed apps use. The post explains which PHP installs Microsoft patches and which ones you must patch.

Agentic Copilot Autofix for code and dependency alerts in Azure DevOps

Copilot Autofix for GitHub Advanced Security in Azure DevOps now runs on an agentic foundation. It proposes fixes as pull requests for code scanning alerts from third-party tools and for dependency vulnerabilities. Your team still makes the final merge decision, so the fixes need to be reviewed like any other change.