Directories
¶
| Path | Synopsis |
|---|---|
|
Package all registers every detector.
|
Package all registers every detector. |
|
Package emudhra is the detector for the eMudhra intermediate CA keys compromised in October 2026 (Mozilla bug 2083449): trust stores, keystores, bundles and binaries that still trust them, Go binaries without Go's blocklist, and servers presenting certificates the compromised keys signed.
|
Package emudhra is the detector for the eMudhra intermediate CA keys compromised in October 2026 (Mozilla bug 2083449): trust stores, keystores, bundles and binaries that still trust them, Go binaries without Go's blocklist, and servers presenting certificates the compromised keys signed. |
|
internal/assess
Package assess decides whether each finding is live trust or an inert copy.
|
Package assess decides whether each finding is live trust or an inert copy. |
|
internal/detect
Package detect inspects one file's bytes and reports facts about it.
|
Package detect inspects one file's bytes and reports facts about it. |
|
internal/knowledge
Package knowledge holds the certificates involved in the October 2026 eMudhra intermediate CA key compromise (Mozilla bug 2083449) and the facts the scanner matches on.
|
Package knowledge holds the certificates involved in the October 2026 eMudhra intermediate CA key compromise (Mozilla bug 2083449) and the facts the scanner matches on. |
|
internal/weakkey
Package weakkey finds elliptic-curve public keys whose private scalar is tiny.
|
Package weakkey finds elliptic-curve public keys whose private scalar is tiny. |
|
Package php2shell is the detector for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), the two remote code execution flaws in the PHP engine fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026.
|
Package php2shell is the detector for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), the two remote code execution flaws in the PHP engine fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21, 2026. |
|
internal/assess
Package assess decides, for each PHP runtime found, whether it is vulnerable to CVE-2026-109618 and CVE-2026-109619, fixed, or unknown, and why.
|
Package assess decides, for each PHP runtime found, whether it is vulnerable to CVE-2026-109618 and CVE-2026-109619, fixed, or unknown, and why. |
|
internal/detect
Package detect recognises PHP runtimes (the CLI, PHP-FPM, CGI, the Apache module, LiteSpeed, FrankenPHP and embedded builds) by content, not by name, and reads the version each one was built as.
|
Package detect recognises PHP runtimes (the CLI, PHP-FPM, CGI, the Apache module, LiteSpeed, FrankenPHP and embedded builds) by content, not by name, and reads the version each one was built as. |
|
internal/fix
Package fix proposes and applies deterministic one-line fixes for image references that carry a PHP release vulnerable to CVE-2026-109618 and CVE-2026-109619.
|
Package fix proposes and applies deterministic one-line fixes for image references that carry a PHP release vulnerable to CVE-2026-109618 and CVE-2026-109619. |
|
internal/image
Package image opens a container image and yields its final filesystem.
|
Package image opens a container image and yields its final filesystem. |
|
internal/knowledge
Package knowledge holds everything the scanner knows about CVE-2026-109618 and CVE-2026-109619: the upstream releases that fix them and, per distribution, the package versions that fix them or are known to be vulnerable.
|
Package knowledge holds everything the scanner knows about CVE-2026-109618 and CVE-2026-109619: the upstream releases that fix them and, per distribution, the package versions that fix them or are known to be vulnerable. |
|
internal/netguard
Package netguard is the HTTP transport for registry lookups.
|
Package netguard is the HTTP transport for registry lookups. |
|
internal/pkgdb
Package pkgdb reads the package databases a system or container image carries (dpkg, apk, rpm) and answers which installed package owns a file, so a PHP binary installed by a distribution is judged by that distribution's fix and not by its upstream version string.
|
Package pkgdb reads the package databases a system or container image carries (dpkg, apk, rpm) and answers which installed package owns a file, so a PHP binary installed by a distribution is judged by that distribution's fix and not by its upstream version string. |
|
internal/pkgdb/rpmdb
Package rpmdb lets pkgdb read rpm sqlite databases (rpmdb.sqlite, rpm 4.16 and later: RHEL 9, Fedora 33+, Amazon Linux 2023, SLES 16).
|
Package rpmdb lets pkgdb read rpm sqlite databases (rpmdb.sqlite, rpm 4.16 and later: RHEL 9, Fedora 33+, Amazon Linux 2023, SLES 16). |
|
internal/refs
Package refs finds container image references in a source repository: Dockerfiles and Containerfiles, Compose files, Kubernetes, OpenShift and Knative manifests (including rendered Helm output), Helm values files, and CI configuration (GitHub Actions, GitLab CI, Bitbucket Pipelines).
|
Package refs finds container image references in a source repository: Dockerfiles and Containerfiles, Compose files, Kubernetes, OpenShift and Knative manifests (including rendered Helm output), Helm values files, and CI configuration (GitHub Actions, GitLab CI, Bitbucket Pipelines). |
|
internal/registry
Package registry resolves image references against their registries and decides, from image configuration alone, which PHP release each platform of an image carries.
|
Package registry resolves image references against their registries and decides, from image configuration alone, which PHP release each platform of an image carries. |
|
internal/registry/registrytest
Package registrytest runs an in-memory OCI registry for tests and builds images that look like the official php image and images derived from it.
|
Package registrytest runs an in-memory OCI registry for tests and builds images that look like the official php image and images derived from it. |
|
internal/repocheck
Package repocheck judges the image references found in a repository: it resolves each one (once per distinct reference) and assesses it with registry.Assess.
|
Package repocheck judges the image references found in a repository: it resolves each one (once per distinct reference) and assesses it with registry.Assess. |
|
internal/report
Package report renders scan results as text, JSON or SARIF.
|
Package report renders scan results as text, JSON or SARIF. |
|
internal/reposcan
Package reposcan checks the image references in a source tree and plans the fix for each vulnerable one.
|
Package reposcan checks the image references in a source tree and plans the fix for each vulnerable one. |
|
internal/source
Package source feeds files to the scanner from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.
|
Package source feeds files to the scanner from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have. |
|
internal/version
Package version parses PHP release versions and compares distribution package versions with each package manager's own rules (dpkg, apk, rpm).
|
Package version parses PHP release versions and compares distribution package versions with each package manager's own rules (dpkg, apk, rpm). |
Click to show internal directories.
Click to hide internal directories.