A Docker image can contain PHP, a web server, application code and system libraries. A container is a running instance of that image. This packaging makes deployments repeatable, but it also means the application may use software entirely different from what is installed on the host.
Updating PHP on the host does not normally update PHP inside an existing container image. To correct an image-level vulnerability, maintainers usually update the image source or base image, build a new image and deploy new containers from it.
A tag alone is not permanent proof of content because tags can be moved. Image digests provide a stronger way to identify the precise image deployed. Multi-platform images can also contain different builds for different processor architectures.
For security verification, inspect the application's image and its package contents, rebuild from maintained sources, deploy the corrected image and check the running container rather than only the host.