// Microsoft Defender XDR advanced hunting, not Sentinel: Defender Vulnerability Management tables are not ingested into Sentinel.
// PHP found by Defender Vulnerability Management, by branch, against the fixed releases of 21 October 2026.
// On Linux the inventory covers PHP installed with the package manager, not PHP built from source or inside containers.
// Distributions often fix PHP without changing the version number: check "below the fixed release" rows against your distribution's advisory.
let Fixed = datatable(Branch: string, FixedVersion: string) ["8.5", "8.5.12", "8.4", "8.4.27", "8.3", "8.3.36", "8.2", "8.2.35"];
DeviceTvmSoftwareInventory
| where SoftwareName has "php"
| extend Numeric = extract(@"^(\d+\.\d+\.\d+)", 1, SoftwareVersion)
| extend Branch = extract(@"^(\d+\.\d+)", 1, Numeric)
| join kind=leftouter Fixed on Branch
| extend Status = case(isempty(Numeric), "Version not recognised", isempty(FixedVersion), "No official fix: PHP 8.1 or older", parse_version(Numeric) < parse_version(FixedVersion), "Below the fixed release", "At or above the fixed release")
| summarize Devices = dcount(DeviceId), Examples = make_set(DeviceName, 10) by SoftwareVendor, SoftwareName, SoftwareVersion, Status
| order by Status asc, Devices desc