An installed package usually has more detail than the software's own version banner. A Debian package can carry a distribution-specific revision, while an RPM package has version, release and architecture fields. These values distinguish rebuilds or backported fixes that may preserve the same upstream software version.
For PHP patch investigations, that extra detail can be decisive. A vendor's security advisory may name a fixed package release, not merely a PHP major and minor version. A scanner that looks only at php -v can miss that distinction.
Build identifiers must be interpreted within their package ecosystem. A package label from one distribution is not directly comparable with a label from another, and the same machine may contain multiple PHP package streams.
Record the full package name, version, release, architecture and repository or vendor. Match those fields to the official advisory, then confirm that the workload uses that installed build.