SonarQube container scanning is now in open beta

The layer your code scans don’t see

You already verify the code you write and the dependencies you import in SonarQube. The images you ship add another layer: operating system packages, language runtimes and libraries that never appear in your repository. Teams often check that layer in a separate tool and end up with a second set of findings to reconcile. Container scanning brings it natively into SonarQube. Risks in your images show up next to the risks in your code and dependencies, in the same workflow. Container scanning is included in SonarQube Advanced Security. 

Why scan the image?

Securing your application runtime is as important as securing your dependencies. This week, two critical issues landed in the layer beneath application code: the PHP2Shell flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619, fixed Oct 21) and the compromise of eight eMudhra intermediate CA keys, which affects the certificate trust store your images and runtimes rely on. Neither is in your code or your declared dependencies. Both live in your images.

Container scanning is built for that layer. It flags known exposure where a vendor advisory or CVE describes it, and it keeps checking images you have already analyzed. Below, we show how to check your images for PHP2Shell.

How does SonarQube container scanning work?

1. Scan. You run the Sonar container scanner CLI against an image, locally or in CI.
2. Analyze. The scanner generates an SBOM for the image and sends it to SonarQube Cloud, which checks the components for known vulnerabilities and malicious packages.
3. Review. Results appear in the scanner output and in SonarQube Cloud under Container images.
4. Stay current. SonarQube Cloud re-checks analyzed images for newly published vulnerabilities, based on your organization’s re-analysis settings, so you do not need to re-scan an image to learn about new ones.

For images based on Red Hat Enterprise Linux, Debian 11 and higher, Rocky Linux, AlmaLinux, Ubuntu and Alpine, vulnerability tracking includes vendor security advisories from those distributions.

How do I get started with SonarQube container scanning?

You need:

• a SonarQube Cloud organization with SonarQube Advanced Security;
• a SonarQube Cloud user token;
• the image available locally or in CI

Download the scanner for Linux, macOS or Windows from the scanner download page, then run as shown below. Rename it to sonar-container-scanner and add it to your PATH.

sonar-container-scanner <IMAGE> --organization <ORGANIZATION_KEY> --token <TOKEN>

By default, the scanner exits with a failing code when it finds risks of high severity or above, so your pipeline can stop a risky image. Use --fail-on to change the threshold.

docker build -t my-app:${BUILD_TAG} .
sonar-container-scanner my-app:${BUILD_TAG} --fail-on high

The container scanning documentation covers CI secrets, supported image inputs, caching and every option.

How to check container images for PHP2Shell 

PHP2Shell is a pair of critical flaws in the PHP runtime itself (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0). They let an attacker run code on a web server without logging in, and they affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php and php-cgi. Fixes shipped on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Because the flaws are in PHP, not in your application code or its Composer packages, code analysis and dependency analysis will not flag them. In SonarQube, they show up through container scanning, as security advisories from the Linux distribution that packaged PHP in your image.

Check your images in three steps

1. Run the scanner on every image that runs PHP. If you scanned an image before October 21, run it again so the findings and severity are current.
   sonar-container-scanner my-php-app:latest --fail-on high
2. In SonarQube Cloud, open Container images, select the image, and look for CVE-2026-109618 or CVE-2026-109619 in its risks. They may appear under the distribution’s own advisory (for example a Debian or Ubuntu advisory), with the CVE listed alongside it.
3. Update PHP. Rebuild the image on a patched base image or with the updated distribution package, then scan it again to confirm the risk is gone.

What container scanning can and can’t see

• Detected: PHP installed from your distribution’s package manager (for example apt install php8.x on Debian or Ubuntu) on a supported base image, once that distribution has published its advisory. Debian and Ubuntu advisories are already available, and others are added as each distribution publishes them.
• Not detected:It does not detect PHP compiled from source including the official php images on Docker Hub and images built on them, such as wordpress, drupal and nextcloud. For these images, check the version inside the container with php -v and update to a fixed release.

What do you see in SonarQube Cloud?

Select Container images in the sidebar of your organization to see every image you have analyzed, with its tag, number of risks, most severe risk and when it was last analyzed. Open an image to see its versions and their risks, and manage them with the same workflow you use for dependency risks in your projects. To refresh results after an image itself changes, run the scanner again.

Why use SonarQube for container scanning?

SonarQube is the independent verification and governance platform for the code you write, the dependencies you import, and now the images you ship. It doesn’t depend on any one cloud, model or agent vendor. For container images, that means:

• One place for all of it. Image risks sit next to your code and dependency risks, in the same workflow.
• Checks where developers build. Run it locally or in CI, and stop a risky image before it ships.
• An inventory that stays current. Every image version you analyze is re-checked as new vulnerabilities are published.

Container scanning is included with SonarQube Advanced Security at no additional cost.

What is in the beta ?

In scope today:

• SonarQube Cloud, for organizations with SonarQube Advanced Security on the Team or Enterprise plan.
• Vulnerability tracking for images based on Red Hat Enterprise Linux, Debian 11 and higher, Rocky Linux, AlmaLinux, Ubuntu and Alpine.
• Scanning of images available locally, either on your machine or in the CI.

This is a beta, and your feedback shapes what comes next.

Try it today

Read the container scanning docs and run your first scan on an image you already build.