Microsoft Warns Azure DevOps Users to Manually Patch PHP Vulnerabilities Amid Critical Flaws

Microsoft has issued a significant advisory to users of Azure DevOps, emphasizing the need for manual intervention to address recently discovered critical vulnerabilities in PHP. The advisory clarifies that while Azure DevOps Services and Azure DevOps Server do not use PHP for their core operations handling customer requests, any PHP installations within user-defined pipeline steps, custom container images, or deployed applications are the customer's responsibility to patch. This comes after the October 21 disclosure of two critical remote code execution (RCE) flaws in PHP, identified as CVE-2026-109618 and CVE-2026-109619. This situation is critical for practitioners because it underscores a common misconception in cloud environments: that the cloud provider handles all aspects of security. In reality, a shared responsibility model dictates that while Microsoft secures the underlying infrastructure, customers are responsible for the security of their applications and the configurations within them. Unpatched PHP vulnerabilities, especially RCE flaws, can lead to complete system compromise, data breaches, and significant operational disruption. Any organization utilizing PHP in their Azure DevOps workflows, regardless of how minor the component, is directly affected and at risk if these patches are not applied. This incident fits into a broader, well-established trend in cloud and DevOps security where supply chain vulnerabilities and the security of third-party components are increasingly targeted. Attackers are shifting their focus from directly attacking cloud infrastructure to exploiting weaknesses in application dependencies and development pipelines. The rapid disclosure and subsequent exploitation attempts of these PHP vulnerabilities (traffic reportedly increased from thousands to millions of attempts following disclosure) illustrate the shrinking window between vulnerability disclosure and active exploitation. This trend necessitates a proactive and continuous approach to vulnerability management, extending beyond the core platform to every component within the software supply chain. In practice, DevOps teams and cloud engineers should immediately undertake a comprehensive inventory of all PHP installations across their Azure DevOps pipelines, custom build agents, and deployed applications. This includes checking Dockerfiles, build scripts, and application runtime environments. Prioritize upgrading to the recommended patched PHP versions. While Azure Web Application Firewall (WAF) can offer some temporary mitigation, it should not be considered a substitute for direct patching. Furthermore, organizations should integrate automated vulnerability scanning tools into their CI/CD pipelines to detect such dependencies early and enforce policies that prevent the deployment of applications with known vulnerabilities. Regular security audits and penetration testing that specifically target third-party components and application dependencies are also crucial to maintaining a robust security posture.