Classic failure mode: the green environment gets tagged from a cached base image, so the deploy is green but the runtime is still the unpatched PHP. Pinning the base image digest and forcing a rebuild on security releases is the boring fix that prevents exactly this.