Vulnerability Reportphp:8.5.9-cli-alpine3.24

This base/runtime image ships critical vulnerabilities that any image built on it would inherit; they must be remediated before the final image goes to production. Remote attackers could run code inside the PHP runtime, and because the container runs as root, that code would carry root privileges and could expose data or disrupt the service built on top. Both top PHP flaws, CVE-2026-109618 and CVE-2026-109619, are actively exploited and enabled in the default configuration, so anyone who can reach a PHP-serving port can attempt them; the image's default root user and missing non-root setup amplify the impact. Remediation means upgrading PHP to a fixed release and rebuilding the final image, since no configuration change in this image removes these flaws. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.