APT resolves dependencies and obtains packages from configured repositories. Administrators commonly use apt to refresh package indexes, inspect candidate versions and apply updates. The packages themselves carry distribution-specific versions that may include security backports.
That is especially relevant when assessing PHP. A repository can supply a corrected PHP package without changing the upstream version displayed by the interpreter. The installed package revision and the distribution's security advisory are better evidence of the specific fix.
APT works within the repositories and release configuration it has been given. A server pointed at old, unsupported or third-party repositories may not receive the updates expected for its operating-system release. Updating the host does not automatically rebuild application containers.
Check the configured sources, installed package version and official advisory. Apply updates through the trusted repository, restart affected services and verify the running application rather than relying only on the successful apt command.