SonarQube container scanning is now in open beta

SonarQube Cloud has introduced container scanning in open beta for Advanced Security customers on Team and Enterprise plans at no extra cost, enabling organizations to identify known vulnerabilities and malicious packages within container images alongside existing code and dependency findings. The scanner runs locally or in CI, generates an SBOM, evaluates image components against vulnerability and vendor-advisory data, and can fail builds according to a configurable severity threshold. Results are displayed in the Container images area of SonarQube Cloud and are continuously re-evaluated as new vulnerabilities emerge, reducing the need to rescan unchanged images solely for updated intelligence. The service supports images based on several major Linux distributions, including Red Hat Enterprise Linux, Debian 11 or later, Rocky Linux, AlmaLinux, Ubuntu, and Alpine. The announcement highlights PHP2Shell, two critical PHP runtime flaws fixed in specific PHP releases on October 21, as an example of risks that may exist in image layers rather than application code or declared dependencies; users are advised to scan affected PHP images, update to patched packages or base images, rebuild, and rescan to verify remediation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.