Vulnerability Reportphp:8.3.36

This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The most significant item is CVE-2026-6653 in libxml2, which could crash a PHP process that parses attacker-supplied XML, and it only applies if such an application is added. Several other libxml2 flaws, such as CVE-2026-86138, could lead to code execution, but they also require an application that processes untrusted XML or URIs through libxml2, which this bare PHP shell does not do by default. Images built from this base should update libxml2 and avoid parsing untrusted XML unless it is needed. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.