Vulnerable PHP Minor Versions

[Vulkarin]

Hello, currently PHP minor version is outdated which makes it vulnerable to CVE-2026-7261. This affects the following versions:

• 8.2.* before 8.2.31
• 8.3.* before 8.3.31
• 8.4.* before 8.4.21

Our team is currently on the 8.2 stack, but it only goes up to 8.2.30. I started testing with 8.4 and saw that only goes up to 8.4.16, so we would be vulnerable either way. Could we get PHP updated?

[soderlind]

According to Microsoft, "Automatic security patches: Updates are applied within 45 days, following the support policy, to keep your WordPress site secure." This is untrue. PHP 8.4.16 is the most recent version of 8.4, having been updated in January.

I had to take action because of CVE-2026-7261 and the PHP 30 July 2026 security releases.

Use these instructions to replace the Microsoft App Service WordPress image: https://github.com/soderlind/replace-appservice-wordpress