Unable to detect PHP2Shell

[choffa]

IDs

CVE-2026-109618, CVE-2026-109619

Description

Trivy seems unable to detect PHP2Shell. These are found in core PHP, but from what I can see Trivy only scans installed dependencies, while not detecting the PHP version itself

Reproduction Steps

1. Run `trivy image php:8.2.30`
2. Observe that CVE's do not appear as they should. 8.2.35 is the patched version

Target

Container Image

Scanner

Vulnerability

Target OS

No response

Debug Output

2026-10-22T14:15:44+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2026-10-22T14:15:44+02:00	DEBUG	Cache dir	dir="/Users/christopher.gjovag/Library/Caches/trivy"
2026-10-22T14:15:44+02:00	DEBUG	Cache dir	dir="/Users/christopher.gjovag/Library/Caches/trivy"
2026-10-22T14:15:44+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-10-22T14:15:44+02:00	DEBUG	Ignore statuses	statuses=[]
2026-10-22T14:15:44+02:00	DEBUG	DB update was skipped because the local DB is the latest
2026-10-22T14:15:44+02:00	DEBUG	DB info	schema=2 updated_at=2026-10-22T07:10:52.423530461Z next_update=2026-10-23T07:10:52.423530061Z downloaded_at=2026-10-22T11:24:32.432238Z
2026-10-22T14:15:44+02:00	DEBUG	[pkg] Package types	types=[os library]
2026-10-22T14:15:44+02:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2026-10-22T14:15:44+02:00	INFO	[vuln] Vulnerability scanning is enabled
2026-10-22T14:15:44+02:00	INFO	[secret] Secret scanning is enabled
2026-10-22T14:15:44+02:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-10-22T14:15:44+02:00	INFO	[secret] Please see https://trivy.dev/docs/v0.76/guide/scanner/secret#recommendation for faster secret detection
2026-10-22T14:15:44+02:00	DEBUG	Initializing scan cache...	type="fs"
2026-10-22T14:15:44+02:00	DEBUG	[notification] Running version check and sending anonymous telemetry
2026-10-22T14:15:44+02:00	DEBUG	[notification] Version check completed	latest_version="0.76.1"
2026-10-22T14:15:45+02:00	DEBUG	[image] Image found	image="php:8.2.30" source="remote"
2026-10-22T14:15:45+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2026-10-22T14:15:45+02:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2026-10-22T14:15:45+02:00	DEBUG	Created process-specific temp directory	path="/var/folders/_j/13k0g7012838kx5383gv0z7r0000gp/T/trivy-271318333"
2026-10-22T14:15:46+02:00	DEBUG	[image] Detected image ID	image_id="sha256:8d8b91529da9ccf9d0bdf5525229d2d9761d875b458b89cc908e1ba3a3c71cd7"
2026-10-22T14:15:46+02:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:6d7c150df58d41c351cd9b03f1cda7a9a23d6fc91436e2bf0f098c6dd78c9c55 sha256:bef8bd98347fa8d293df3242f13151ec2f95e3baacdb7614a272c280c1b1299d sha256:60dfb7d645e7faf91e634872ede8dbcfb29ff3a1b9fcf24cadc32b74451a820c sha256:7c613e5e583474cbc46aedc4cd63d95b4ab2bc42c0164c725d901a92b4e12f3a sha256:91af44b6211abb5e702a686acaa0f48548fd39f022bd644be6b310e7028c7a21 sha256:cf6f38864438bd99d3af2c71d3fc79a34cf3ea52f71e0f92034939d93147a863 sha256:aa0ed0e2f461357402461c28c79828c82f894a81e308623c505d72d1c8106126 sha256:4bc263b77d413ac084cf1ce88f1b36260fa5efaeeab587658e7303ec91ff2ff0 sha256:a3a27e5bc9f234d3e55b18c8068ba2d7a92221aecfe470893b1be3e8f3215bc1 sha256:9eae911b674d025db583b5e275a36d617f5675bab484fecacced61dcfccb480a]
2026-10-22T14:15:46+02:00	DEBUG	[image] Detected base layers	diff_ids=[]
2026-10-22T14:15:46+02:00	INFO	Detected OS	family="debian" version="13.4"
2026-10-22T14:15:46+02:00	INFO	[debian] Detecting vulnerabilities...	os_version="13" pkg_num=172
2026-10-22T14:15:46+02:00	INFO	Number of language-specific files	num=0
2026-10-22T14:15:46+02:00	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.76/guide/scanner/vulnerability#severity-selection for details.
2026-10-22T14:15:46+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2026-10-22T14:15:46+02:00	DEBUG	[vex] VEX filtering is disabled
2026-10-22T14:15:46+02:00	DEBUG	[notification] Printing notices

Version

Version: 0.76.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-10-22 07:10:52.423530461 +0000 UTC
  NextUpdate: 2026-10-23 07:10:52.423530061 +0000 UTC
  DownloadedAt: 2026-10-22 11:24:32.432238 +0000 UTC
Check Bundle:
  Digest: sha256:b591e9190cff4aa4e385b1a25bccfd9ecf178d3c77fd194e1410b7ce7e1df058
  DownloadedAt: 2026-10-22 11:19:25.015925 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[zuhairhalawa]

Your read is right, and it matches how Trivy is documented rather than a missing advisory. Trivy reports CVEs for packages it can identify: OS packages (dpkg, apk, rpm) matched against the distro vendor's advisories, and language dependencies such as Composer packages found through composer.lock or installed.json. The official php images build PHP from the php.net source tarball (./configure, make, make install in the image's Dockerfile), so the interpreter is not a dpkg package, and it is not a Composer package either.

The "Non-packaged software" section of the vulnerability scanner docs lists the only cases where Trivy detects software that is not managed by a package manager: an SBOM from Sigstore Rekor, Go binaries, Rust binaries and an SBOM embedded in the image. A php binary is not one of them, and the PHP coverage page lists Composer as the only supported PHP package manager.

So php:8.2.30 will not report those CVEs whatever the fixed version is. Practical options are to build on PHP from the distro package manager, so the vendor advisory applies once the vendor publishes it, or to add a separate check of the PHP version (php -v, or the image tag) in the pipeline next to Trivy.

[zuhairhalawa]

If this matches what you were seeing, could you mark the answer as accepted? It will help others who find PHP missing from Trivy results.

[choffa]

Yes it does. I have closed the discussion but for some reason I am not able to mark the answer as accepted...