Images commonly contain application code, a runtime such as PHP and the libraries needed to run it. They may be built in layers from a base image and pushed to a registry for later deployment.
That convenience can preserve old vulnerabilities. If an image was built before a security update, starting another container from the same unchanged image does not normally install the fix. Updating the underlying host also does not rewrite that image's PHP packages.
Image tags are useful labels but may point to different content at different times. A digest identifies a specific image, while architecture-specific manifests determine which build is selected for a particular system.
Track image provenance, digest, operating-system packages and runtime versions in your inventory. Rebuild images after security updates, scan the resulting artifact and verify that production actually runs the new digest.