With mod_php, Apache loads a PHP module, commonly a file named libphp or a versioned equivalent, and runs PHP code within the server process rather than forwarding each request to a separate PHP-FPM service. This changes where operators must look for the active runtime.
Checking a standalone php executable is not enough because the web request may be executed by the module loaded into httpd. Apache's loaded-module list and each worker's memory mappings provide stronger evidence about the actual PHP library in use.
When a package replaces the module file on disk, Apache workers can continue using the old mapped library until they exit. A graceful restart can temporarily preserve old-generation workers while their existing requests finish, so patch verification should include process replacement.
Identify the active Apache module and build, apply the package update, plan a controlled restart, and confirm no workers retain the vulnerable library.