Vulnerability Reportphp:8.5.9-fpm-alpine

This base/runtime image ships critical vulnerabilities that any image built on it would inherit; they must be remediated before the final image goes to production. An attacker reaching the PHP-FPM port could execute code inside the worker, gain control of the application and the data it processes, and disrupt service. The most serious issue, CVE-2026-109618, is exploitable in the default configuration by anyone who reaches port 9000, and the scan shows no authentication or configuration option that closes that path. Rebuild the final image on a patched PHP release and confirm the fix against both CVE-2026-109618 and CVE-2026-109619 before deployment. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.