Check the command-line runtime

The command-line PHP and the PHP serving your website can be different installations. Record both before deciding whether this PHP vulnerability is fixed.

php -v

php -r 'echo PHP_VERSION, PHP_EOL;'

Ubuntu and Debian containers (ARM64); see platform guides for package revisions.

Find the complete package revision

Distribution backports need the full package revision. Select your Ubuntu or Debian guide and compare the installed revision with its source. Do not treat an upstream-looking number as proof of a PHP vulnerability fix.

Check your hosting panel or application

In cPanel, inspect the PHP runtime assigned to the domain in MultiPHP Manager. For WordPress, use Tools → Site Health → Info → Server, following the WordPress documentation. Ask your host to confirm the complete vendor patch revision.

A temporary PHP information page can disclose configuration and environment data. Use an access-restricted diagnostic method and remove any temporary diagnostic page immediately after inspection.

Verify all running processes

Restart PHP-FPM and Apache using the tested commands in your platform guide or the vendor procedure. Restart long-running queue workers too. For container deployments, recreate the serving containers using the updated image.

Recheck the web runtime after the PHP security update. The CLI result cannot prove which binary is handling web requests or whether every old worker has exited.