Vulnerable PHP Minor Versions

[Vulkarin]

Hello, currently PHP minor version is outdated which makes it vulnerable to CVE-2026-7261. This affects the following versions:

• 8.2.* before 8.2.31
• 8.3.* before 8.3.31
• 8.4.* before 8.4.21

Our team is currently on the 8.2 stack, but it only goes up to 8.2.30. I started testing with 8.4 and saw that only goes up to 8.4.16, so we would be vulnerable either way. Could we get PHP updated?

[soderlind]

According to Microsoft, "Automatic security patches: Updates are applied within 45 days, following the support policy, to keep your WordPress site secure." This is untrue. PHP 8.4.16 is the most recent version of 8.4, having been updated in January.

I had to take action because of CVE-2026-7261 and the PHP 30 July 2026 security releases.

Use these instructions to replace the Microsoft App Service WordPress image: https://github.com/soderlind/replace-appservice-wordpress

[jwhazel]

I'm getting the feeling this project may have been abandoned by Microsoft. I'd love to be wrong about this. But it's been an entire year since any meaningful bump to the dependencies has been merged #205. I'm still not sure what the Tuxprod releases are supposed to be. But I've scanned the most recent ones (as of August 13 2026) and they're all still stuck on old vulnerable PHP versions.

Definitely appreciate soderlind's suggestion. Rolling your own image is certainly one way to get around this issue. But for those of those of us who don't have enough bandwidth to keep up with that:

1.) check to see if you actually have something that uses the built in SOAP library. Chances are pretty good you do not:

grep -RIn \
  --include='*.php' \
  --exclude-dir=uploads \
  --exclude-dir=cache \
  -E 'new[[:space:]]+\\?SoapServer[[:space:]]*\(' \
  .

2.) If no, then create a startup script touch /home/dev/startup.sh

3.) Paste the following in and then restart the server

#!/bin/bash

rm -f /usr/local/etc/php/conf.d/docker-php-ext-soap.ini

supervisorctl restart php-fpm

This will prevent the SOAP extension from loading. Obviously it's not a solution to future non-SOAP related CVE's. But it buys enough time for me to focus on finding a better solution than Microsofts managed container.