How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady.
thats chainguard’s entire value prop (they are quite well known in this sphere)
Good luck getting them to fix broken packages though.
Is there a public announcement? I can only see PHP 8.5.11 images, but having a recent build date is not enough to say they are indeed patched.