Azure App Service (Windows) - PHP 5.6.40 visible in Kudu for .NET Framework application, security exposure concern

We have several Azure App Service (Windows) applications hosting**.NET Framework** workloads. We do not deploy or use PHP as part of our applications.

During a security review following recently disclosed PHP vulnerabilities, we accessed the Kudu console and executed: php -v

The output reports PHP 5.6.40.

We found historical Azure App Service announcements indicating that PHP 5.6.40 was provided on the App Service platform and included Microsoft security backports for supported fixes. [azure.github.io], [github.com]

We would appreciate clarification from the Azure App Service team on the following:

If a customer is hosting only .NET Framework applications and does not deploy or execute PHP code, does the presence of PHP 5.6.40 in the Kudu/App Service environment introduce exposure to recently disclosed PHP vulnerabilities?

Is the PHP runtime accessible through any App Service management endpoints (including Kudu/SCM) in a manner that could expose customers who are not actively using PHP?

Is the PHP binary shown in Kudu part of the Microsoft-managed App Service worker image, and can it be removed or updated by customers?

For customers not using PHP, are there any recommended mitigation steps beyond restricting access to Kudu/SCM endpoints and ensuring no PHP content is deployed?

Is there any current Microsoft guidance regarding PHP runtimes that remain visible on Windows App Service workers but are not actively used by the hosted application?

Thank you for any clarification the App Service engineering team can provide.