From 69b80f6a3f7fac9324d5f6826391faf775fc3700 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= <98956809+puchy22@users.noreply.github.com> Date: Thu, 22 Oct 2026 15:33:06 +0200 Subject: [PATCH] chore(azure): raise App Service PHP latest version default to 8.5 (#13128) --- contrib/k8s/helm/prowler-api/values.yaml | 2 +- docs/user-guide/cli/tutorials/configuration_file.mdx | 4 ++-- .../azure-php-latest-version-8-5.changed.md | 1 + prowler/config/config.yaml | 2 +- prowler/config/schema/azure.py | 2 +- .../app_ensure_php_version_is_latest.metadata.json | 10 +++++----- .../app_ensure_php_version_is_latest.py | 2 +- tests/providers/azure/azure_provider_test.py | 2 +- ui/changelog.d/azure-php-latest-version-8-5.changed.md | 1 + ui/lib/yaml.ts | 2 +- 10 files changed, 15 insertions(+), 13 deletions(-) create mode 100644 prowler/changelog.d/azure-php-latest-version-8-5.changed.md create mode 100644 ui/changelog.d/azure-php-latest-version-8-5.changed.md diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml index 5332f9d2eb..d1c2819075 100644 --- a/contrib/k8s/helm/prowler-api/values.yaml +++ b/contrib/k8s/helm/prowler-api/values.yaml @@ -502,7 +502,7 @@ mainConfig: # Azure App Service # azure.app_ensure_php_version_is_latest - php_latest_version: "8.2" + php_latest_version: "8.5" # azure.app_ensure_python_version_is_latest python_latest_version: "3.12" # azure.app_ensure_java_version_is_latest diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx index a1c14e6626..a568568fff 100644 --- a/docs/user-guide/cli/tutorials/configuration_file.mdx +++ b/docs/user-guide/cli/tutorials/configuration_file.mdx @@ -214,7 +214,7 @@ The following list includes all the Azure checks with configurable variables tha | `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_minutes` | Integer | `1440` | | `apim_threat_detection_llm_jacking` | `apim_threat_detection_llm_jacking_threshold` | Float | `0.1` | | `app_ensure_java_version_is_latest` | `java_latest_version` | String | `"17"` | -| `app_ensure_php_version_is_latest` | `php_latest_version` | String | `"8.2"` | +| `app_ensure_php_version_is_latest` | `php_latest_version` | String | `"8.5"` | | `app_ensure_python_version_is_latest` | `python_latest_version` | String | `"3.12"` | | `defender_attack_path_notifications_properly_configured` | `defender_attack_path_minimal_risk_level` | String | `"High"` | | `network_public_ip_shodan` | `shodan_api_key` | String | `null` | @@ -719,7 +719,7 @@ azure: # Azure App Service # azure.app_ensure_php_version_is_latest - php_latest_version: "8.2" + php_latest_version: "8.5" # azure.app_ensure_python_version_is_latest python_latest_version: "3.12" # azure.app_ensure_java_version_is_latest diff --git a/prowler/changelog.d/azure-php-latest-version-8-5.changed.md b/prowler/changelog.d/azure-php-latest-version-8-5.changed.md new file mode 100644 index 0000000000..61bef33839 --- /dev/null +++ b/prowler/changelog.d/azure-php-latest-version-8-5.changed.md @@ -0,0 +1 @@ +Default `php_latest_version` for `app_ensure_php_version_is_latest` raised from `8.2` to `8.5`, the newest PHP runtime on Azure App Service for Linux, following the PHP2Shell (CVE-2026-109618, CVE-2026-109619) security release diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml index 0c7551d634..e364c80284 100644 --- a/prowler/config/config.yaml +++ b/prowler/config/config.yaml @@ -551,7 +551,7 @@ azure: # Azure App Service # azure.app_ensure_php_version_is_latest - php_latest_version: "8.2" + php_latest_version: "8.5" # azure.app_ensure_python_version_is_latest python_latest_version: "3.12" # azure.app_ensure_java_version_is_latest diff --git a/prowler/config/schema/azure.py b/prowler/config/schema/azure.py index 75954c602b..e9253f04c4 100644 --- a/prowler/config/schema/azure.py +++ b/prowler/config/schema/azure.py @@ -36,7 +36,7 @@ class AzureProviderConfig(ProviderConfigBase): # --- App Service ---------------------------------------------------- php_latest_version: Annotated[ Optional[str], AfterValidator(_validate_dotted_version) - ] = Field(default=None, description='PHP minimum acceptable version, e.g. "8.2".') + ] = Field(default=None, description='PHP minimum acceptable version, e.g. "8.5".') python_latest_version: Annotated[ Optional[str], AfterValidator(_validate_dotted_version) ] = Field( diff --git a/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.metadata.json b/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.metadata.json index 41f90cac3d..900c1c73e9 100644 --- a/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.metadata.json +++ b/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.metadata.json @@ -1,7 +1,7 @@ { "Provider": "azure", "CheckID": "app_ensure_php_version_is_latest", - "CheckTitle": "App Service web app uses the latest supported PHP version or 8.2 by default", + "CheckTitle": "App Service web app uses the latest supported PHP version or 8.5 by default", "CheckType": [], "ServiceName": "app", "SubServiceName": "", @@ -19,10 +19,10 @@ ], "Remediation": { "Code": { - "CLI": "az webapp config set --resource-group --name --linux-fx-version \"PHP|8.2\"", - "NativeIaC": "```bicep\n// Update App Service runtime to latest PHP\nresource appConfig 'Microsoft.Web/sites/config@2022-09-01' = {\n name: '/web'\n properties: {\n linuxFxVersion: 'PHP|8.2' // Critical: sets the app runtime to PHP 8.2 (latest) to pass the check\n }\n}\n```", - "Other": "1. In Azure Portal, go to App Services and select your app\n2. Navigate to Settings > Configuration > General settings\n3. Under Stack settings, select PHP and set Version to 8.2\n4. Click Save and confirm the restart", - "Terraform": "```hcl\n# Set latest PHP version on Linux Web App\nresource \"azurerm_linux_web_app\" \"app\" {\n name = \"\"\n resource_group_name = \"\"\n location = \"\"\n service_plan_id = \"\"\n\n site_config {\n application_stack {\n php_version = \"8.2\" # Critical: sets PHP to latest to pass the check\n }\n }\n}\n```" + "CLI": "az webapp config set --resource-group --name --linux-fx-version \"PHP|8.5\"", + "NativeIaC": "```bicep\n// Update App Service runtime to latest PHP\nresource appConfig 'Microsoft.Web/sites/config@2022-09-01' = {\n name: '/web'\n properties: {\n linuxFxVersion: 'PHP|8.5' // Critical: sets the app runtime to PHP 8.5 (latest) to pass the check\n }\n}\n```", + "Other": "1. In Azure Portal, go to App Services and select your app\n2. Navigate to Settings > Configuration > General settings\n3. Under Stack settings, select PHP and set Version to 8.5\n4. Click Save and confirm the restart", + "Terraform": "```hcl\n# Set latest PHP version on Linux Web App\nresource \"azurerm_linux_web_app\" \"app\" {\n name = \"\"\n resource_group_name = \"\"\n location = \"\"\n service_plan_id = \"\"\n\n site_config {\n application_stack {\n php_version = \"8.5\" # Critical: sets PHP to latest to pass the check\n }\n }\n}\n```" }, "Recommendation": { "Text": "Standardize on the **latest supported PHP** and avoid EoL releases. Update promptly after security advisories, validate in staging, and automate version governance across apps. Prefer supported Linux runtimes, limit optional extensions, and apply **defense in depth** and **least privilege** to reduce blast radius.", diff --git a/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.py b/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.py index 7ccd31fbb5..8e9f2c62ce 100644 --- a/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.py +++ b/prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.py @@ -24,7 +24,7 @@ class app_ensure_php_version_is_latest(Check): report.status = "FAIL" php_latest_version = app_client.audit_config.get( - "php_latest_version", "8.2" + "php_latest_version", "8.5" ) report.status_extended = f"PHP version is set to '{framework}', the latest version that you could use is the '{php_latest_version}' version, for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'." diff --git a/tests/providers/azure/azure_provider_test.py b/tests/providers/azure/azure_provider_test.py index 5e493a90c7..6d73d04dd9 100644 --- a/tests/providers/azure/azure_provider_test.py +++ b/tests/providers/azure/azure_provider_test.py @@ -83,7 +83,7 @@ class TestAzureProvider: ) assert azure_provider.audit_config == { "shodan_api_key": None, - "php_latest_version": "8.2", + "php_latest_version": "8.5", "python_latest_version": "3.12", "java_latest_version": "17", "recommended_minimal_tls_versions": ["1.2", "1.3"], diff --git a/ui/changelog.d/azure-php-latest-version-8-5.changed.md b/ui/changelog.d/azure-php-latest-version-8-5.changed.md new file mode 100644 index 0000000000..1afb00fc7d --- /dev/null +++ b/ui/changelog.d/azure-php-latest-version-8-5.changed.md @@ -0,0 +1 @@ +Default `php_latest_version` in the scan configuration template raised from `8.2` to `8.5` diff --git a/ui/lib/yaml.ts b/ui/lib/yaml.ts index 35146564c5..6b99b9e797 100644 --- a/ui/lib/yaml.ts +++ b/ui/lib/yaml.ts @@ -288,7 +288,7 @@ aws: azure: defender_attack_path_minimal_risk_level: "High" - php_latest_version: "8.2" + php_latest_version: "8.5" python_latest_version: "3.12" java_latest_version: "17" vm_backup_min_daily_retention_days: 7