Web App (Windows): Old PHP versions present in App Service environment

Question

Web App (Windows): Old PHP versions present in App Service environment

Lee Meyrick 0

NB - This is now a community post because the damn support AI (that I have to pay extra for) ran out of responses.

Problem description

Old PHP binaries, specifically PHP 5.6 and 7.4, are present within the Windows-based App Service Plan, visible via the Kudu console (C:\Program Files (x86)\PHP)

These binaries are significantly past end of life (8 years!) and have known vulnerabilities.

Environment

Web App using Windows App Service Plan

Next Steps

It should not need saying that internet facing systems need to apply security updates and remove programs that do not receive security updates. CISA, NIST and other regimes that Microsoft assure they comply with all have requirements to this effect.

Microsoft should be removing these known vulnerable executables from our systems.

Santhi Siruvuri 5 Reputation points Microsoft External Staff Moderator

2026-10-29T01:27:19.6733333+00:00

Hello @Lee Meyrick ,

Thank you for reaching out to us. We've started looking into this. Since you've already opened a support case , we'll share all updates and next steps by email on that case so everything stays in one place. Please keep an eye on that thread and reply there with any additional details we request.

Thanks for your patience.

Your answer

Santhi Siruvuri 5 Reputation points Microsoft External Staff Moderator

2026-10-29T01:27:19.6733333+00:00

Hello @Lee Meyrick ,

Thank you for reaching out to us. We've started looking into this. Since you've already opened a support case , we'll share all updates and next steps by email on that case so everything stays in one place. Please keep an eye on that thread and reply there with any additional details we request.

Thanks for your patience.