App Service web apps should use the latest 'PHP version' when PHP is part of the app
Newer PHP versions are released due to security flaws or to include additional functionality. This control evaluates the PHP version configured on App Service web apps that include PHP. The Azure Policy applies only to Linux apps.
Using outdated PHP enables exploitation of known flaws, including remote code execution, causing secret disclosure (confidentiality), unauthorized changes (integrity), and crashes or downtime (availability). Deprecated versions lack patches, widening exposure and instability.
What this control checks
Web apps with PHP in the app should use the latest PHP version available
Common pitfalls
Only Linux apps are covered and a PHP version is required
This policy only applies to Linux apps. This policy requires you to specify a PHP version that meets your requirements.
PHPLatestVersion deprecated; LinuxPHPVersion default ""
The LinuxPHPVersion parameter has a defaultValue of "". The PHPLatestVersion parameter is marked deprecated.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps that use PHP should use a specified 'PHP version'" (7261b898-8a84-4db8-9e04-18527132abb3); Prowler check app_ensure_php_version_is_latest (prowler azure --checks app_ensure_php_version_is_latest); PowerPipe control azure_compliance.control.appservice_web_app_latest_php_version.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (6)
- DEV-02.01B In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- OPS-27.01B The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known...
1 more clause
- OPS-33.02B Patch management procedures are harmonised with the cloud service provider's overall software change management process.
- 9.6 Ensure That 'PHP version' is the Latest, If Used to Run the Web App
- 9.5 Ensure That 'PHP version' is the Latest, If Used to Run the Web App
- 9.7 Ensure that 'PHP version' is currently supported (if in use)
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_latest_php_version - Powerpipe Control:
azure_compliance.control.appservice_web_app_latest_php_version - Prowler Check:
app_ensure_php_version_is_latest - Azure Policy Definition:
7261b898-8a84-4db8-9e04-18527132abb3
Last reviewed: 2026-10-11