Content by Josef Sin (2)

Josef Sin explains what Azure DevOps users should check following the PHP2Shell disclosures. Azure DevOps Services and Server do not use PHP to handle customer requests, but pipeline workloads, agent hosts, containers, and deployed applications may require runtime patches. The guidance distinguishes Microsoft-managed updates from fixes customers must apply themselves.

Josef Sin explains what the Axios npm supply chain compromise means for Azure Pipelines users, who is and isn’t impacted, and what to do if your CI/CD runs may have installed the malicious versions—covering agent types, service connections, cache cleanup, and practical mitigation steps.