Vulnerability Reportphp:8.4.27-alpine

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. If an application built on it decodes Brotli-compressed data from untrusted sources, an attacker could possibly run code inside the PHP process, which could expose data or disrupt the service. Note: CVE-2026-111497 only applies if the PHP code fetches or decodes Brotli data through a library that uses this decoder, so images that never handle such data face much less risk. The remaining findings in the scan need local access or a compromised container before they matter, so they do not drive this verdict. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.