I'm wondering if it's not just better to use plain Debian base images.

  FROM debian:... 
  RUN apt install php ...

This will take longer on a cold build cache, and pins the PHP version to the current Debian version. But Debian once again proved very reliable to patch in time.

Those images are not even official. "Official" is just a misnomer in Docker.