I'm currently waiting for a new docker image for another project, and their maintainer noticed the old PHP versions in the freshly built images and is still waiting or working on releasing a new container build.
"Let's use this packaging some rando on the Internet built" is a strategy that is exactly as good as it seems, but that's the Docker ecosystem for you.
Packagers who actually understand the software put in good work to package that software in small and well maintained packages. Use them instead!
FROM debian:...
RUN apt install php ...
This will take longer on a cold build cache, and pins the PHP version to the current Debian version. But Debian once again proved very reliable to patch in time. $ docker pull wordpress:fpm && docker image inspect wordpress:fpm --format '{{.Created}}' && docker run --rm wordpress:fpm php --version
fpm: Pulling from library/wordpress
Digest: sha256:c6d271a445510a3e08cfcc487750ac014f4464165ad6df6356da04680be8e907
Status: Image is up to date for wordpress:fpm
docker.io/library/wordpress:fpm
2026-10-21T01:27:06.695704995Z
PHP 8.3.35 (cli) (built: Oct 21 2026 00:33:17) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.35, Copyright (c) Zend Technologies
with Zend OPcache v8.3.35, Copyright (c), by Zend Technologies
I guess they were planning an update for today, for a moment the 8.2.35 threw me, but .35 is patched on 8.2, unpatched on 8.3 :)