Classic failure mode: the green environment gets tagged from a cached base image, so the deploy is green but the runtime is still the unpatched PHP. Pinning the base image digest and forcing a rebuild on security releases is the boring fix that prevents exactly this.
Kamran Khan
Full-Stack Web Developer (React.js + Laravel) | Dashboards, SaaS Apps & Management Systems for Global Clients
There is a sibling to this one on servers that upgrade PHP in place rather than rebuilding the image. apt installs the new binary and php -v says 8.5.12, but the running php-fpm pool keeps serving requests from the old one until the service restarts. My rule after any PHP bump is now: restart the FPM pool, then confirm the version through the request path, not just the CLI.