A patched build may come from an official PHP release, a Linux distribution or a commercial hosting provider. These routes can have different version numbers and package identifiers even when they all contain the same relevant fix.
The important evidence is not simply that the version looks recent. A vendor may keep an older PHP version label and backport a security fix, or a newer-looking binary may belong to the wrong installed runtime. The exact package release and source of the build matter.
There is also a difference between a package being installed and a patched build actually processing requests. PHP-FPM workers, containers and background processes may need to be replaced before the corrected binary is in use.
For each affected application, establish the vendor's fixed package or upstream release, install it through the supported update channel, restart the relevant runtime and verify the active build.