Hello WebDevOps Team 👋
We use webdevops/php-nginx in production and run a Trivy scan on it every deploy. On this latest scan of webdevops/php-nginx:8.4-alpine, we found a CRITICAL vuln worth flagging.
It's in the go-replace binary bundled inside the image — it's linked against golang.org/x/crypto v0.54.0, which has CVE-2026-56854: an SSH auth bypass caused by unenforced source-address restrictions. Fix is already out in v0.55.0.
Scan details:
trivy image --exit-code 0 --severity CRITICAL --ignore-unfixed --no-progress webdevops/php-nginx:8.4-alpine
Since this is baked into the go-replace binary itself (not an apk package), an apk upgrade won't fix it — probably needs a rebuild of go-replace with the dependency bumped to 0.55.0+.
(Side note: previous CVEs we found in this image were fixed fast, thanks for that 🙌)
Happy to provide more details if needed. Thanks for maintaining this image 🙏
Trivy version used: 0.73.0 (heads up, 0.74.0 is out too if you want to stay current there as well)
Hello WebDevOps Team 👋
We use
webdevops/php-nginxin production and run a Trivy scan on it every deploy. On this latest scan ofwebdevops/php-nginx:8.4-alpine, we found a CRITICAL vuln worth flagging.It's in the
go-replacebinary bundled inside the image — it's linked againstgolang.org/x/cryptov0.54.0, which has CVE-2026-56854: an SSH auth bypass caused by unenforced source-address restrictions. Fix is already out in v0.55.0.Scan details:
trivy image --exit-code 0 --severity CRITICAL --ignore-unfixed --no-progress webdevops/php-nginx:8.4-alpine usr/local/bin/go-replacegolang.org/x/cryptoSince this is baked into the
go-replacebinary itself (not an apk package), anapk upgradewon't fix it — probably needs a rebuild ofgo-replacewith the dependency bumped to 0.55.0+.(Side note: previous CVEs we found in this image were fixed fast, thanks for that 🙌)
Happy to provide more details if needed. Thanks for maintaining this image 🙏
Trivy version used: 0.73.0 (heads up, 0.74.0 is out too if you want to stay current there as well)