Azure WordPress Web App PHP update to version 8.3.19

Question

Encounter an issue on updating Azure WordPress Web App PHP version to 8.3.19 since there are lot of vulnerability with version 8.3.16.

List of Vulnerability

1. CVE-2024-11235 PHP Use-After-Free Vulnerability
2. CVE-2025-1217  PHP Incorrect HTTP Response Header Parsing
3. CVE-2025-1219 PHP Incorrect Wrong HTTP Content-Type Header Flaw

Configuration Azure WordPress App

Is there any method to update the PHP version to 8.3.19 ?

Answer 1

Hi Muhammad Aiman Bin Mohd Isa,

You're right, your Azure WordPress Web App is currently on PHP 8.3.16, which includes several security vulnerabilities. Upgrading to PHP 8.3.19 is a smart move to fix these vulnerabilities and keep your app secure.

Azure App Service updates PHP versions according to its platform support schedule. Currently, PHP 8.3.19 might not appear in the UI stack dropdown, as shown in your screenshot, because Azure only makes new minor versions available after completing internal testing and validation.

You can check the supported PHP versions in the Azure portal under → App Service → Configuration → General Settings → Stack Settings.

1). Use a Custom Docker Image

If PHP 8.3.19 is not yet available in the Azure portal, you can deploy your WordPress app using a custom Docker container that includes PHP 8.3.19. This gives you full control over the PHP version and lets you patch vulnerabilities immediately.

• Create a Docker image using the official WordPress image with PHP 8.3.19, then add your WordPress files and necessary extensions.
• Push the image to Azure Container Registry or Docker Hub.
• Point your Azure App Service (Linux) to the custom container.
• Test in staging before swapping to production.

Use a custom Docker container in Azure App Service

Official PHP Docker images

2). Wait for Azure to Update PHP 8.3.19 in the Stack

If you're not using containers, keep checking the Azure updates page. Microsoft regularly adds new PHP versions, and 8.3.19 should be available soon.

Azure App Service - Language runtime support

App service overview

Always test PHP upgrades in a staging slot and confirm your WordPress plugins and themes are compatible with PHP 8.3.x before updating production.

Please accept as "Yes" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Let me know if you have any further Queries.