[gabauer]

Summary

Bumps the PHP base image of the fpm-alpine variant to PHP 8.4.27.

Why

PHP 8.4.27 (released 2026-10-21) is a security release fixing two critical
vulnerabilities, CVE-2026-109618 and CVE-2026-109619
(GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp), which can allow unauthenticated
remote code execution. According to the PHP security advisory, all PHP
installations serving web requests are affected, including PHP-FPM, and
there is no complete mitigation other than updating.

The German Federal Office for Information Security (BSI) has also issued an
advisory on this (BITS-H 2026-297981-1132, criticality 3/orange, TLP:CLEAR),
rating the vulnerabilities at CVSS 4.0 score 9.2.

Notes

• This PR only touches the fpm-alpine variant. The apache variant
  should probably receive the same update.
• If you prefer to keep the floating php:8.4-fpm-alpine tag and simply
  trigger a rebuild against the updated base image, I'm happy to adjust.

References

• https://www.php.net/ (PHP 8.4.27 release announcement and security advisory)
• GHSA-w8hw-w9fx-j79w
• GHSA-6wmf-4rv5-p3rp

[J0WI]

duplicate of #413

This is also not how Docker images from the official library work. They are rebuild automatically whenever a base images change (i.e. for PHP, OpenSSL etc.). So pinning a single image to a specific hash is counterproductive.