Microsoft

Azure Front Door / Application Gateway / AGC

Response status

WAF mitigations available

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Front Door rule 99006001 is rolling out by October 28 and requires enabling. Application Gateway offers header rewriting; custom rules are documented for the WAF products.

Scope: WAF is a mitigation. Full Front Door rollout was not announced as complete as of October 27. Application Gateway and AGC have different options.

What users should do

Patch PHP and containers. Enable Front Door rule 99006001 when available with Block on anomaly. Check product scope, body inspection and request-size limits; validate custom rules for false positives.

Official service URL

• https://azure.microsoft.com/

Source URLs

1. Microsoft: PHP2Shell upgrade and WAF guidancehttps://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623Response evidence
2. Microsoft: Azure WAF custom ruleshttps://techcommunity.microsoft.com/blog/azurenetworksecurityblog/azure-waf-custom-rules-for-php2shell-mitigation/4566684Response evidence