To establish status, first identify which PHP installation serves the application. Then determine who supplies that installation, such as the PHP project, an operating-system vendor or a hosting provider. The vendor's fixed-build information tells you which package or release contains the remedy.
A single PHP version string is often insufficient. Backported fixes may not change the upstream version number, and a server may carry several versions at once. A command executed on the host may inspect a different runtime from the one inside a container or behind a website.
Patch status can therefore be different for different domains, workers and scheduled jobs on the same machine. It can also change after a deployment rolls back to an earlier image.
Record the affected CVE or advisory, the installed package identifier, the runtime path and the deployment state. Verify the running processes, rather than reporting the entire server as patched from one command.