Alpine packages PHP for its releases and is a common container base. This review did not open an Alpine security advisory that names a fixed apk version, so none is printed here. Look up both CVE IDs in Alpine’s secdb for the Alpine version in your image.
Inside a container, the check is apk info php and the php-fpm binary in that filesystem, not the PHP on the laptop that built the image. If the advisory lists a fixed apk, rebuild the image FROM a refreshed base or upgrade the package in your Dockerfile and roll the workload. An apk upgrade inside a running container disappears when the pod is rescheduled, unless the image itself changed.
Alpine’s php package and the official Docker php image are different lineages. A fix in one is not a fix in the other. Read the image labels.
Until the apk is confirmed, keep the container off the public internet if you can, and apply the temporary PHP settings in the image’s php.ini so the next start picks them up.