A base image is the image that a Docker build starts from, named in the FROM line of a Dockerfile. Everything the new image adds is layered on top of it, so the new image inherits the base image's operating system packages, libraries and any language runtime it includes. For a PHP application, the base image is often what supplies PHP itself, for example an official PHP image or an image that bundles a web server with PHP.
This inheritance matters for patching. If the base image contains a vulnerable component, every image built on it carries that component until it is rebuilt from an updated base. Updating the host system does not change the software inside an existing image, and a running container keeps using what was in the image when it was built.
Seeing which base image a project uses does not by itself tell you whether it is vulnerable. That depends on the exact build the base image tag pointed to when you last built, and on whether the maintainer has published a fixed version. A Dockerfile with several build stages can also name several base images, and only the one used for the final stage ends up in the running image.
To check an image, identify its base from the Dockerfile, then confirm the software version actually inside a running container rather than relying on the tag name alone. When a fixed base image is available, pull it, rebuild your own image, redeploy the containers and verify the result. Check the maintainer's notices for what has changed and for which tags carry the update.