RHEL packages are distributed through Red Hat-maintained channels and supported according to product and subscription policies. Organizations use it for services where stable interfaces, security updates and operational support are important.
Red Hat often backports security corrections to the software versions shipped with a release. A package can therefore carry a fix even when the upstream version displayed by a program remains below the threshold mentioned in a general vulnerability announcement.
RHEL patch verification should use the exact package version and release, the appropriate Red Hat security advisory and the system's configured repositories. Looking only at php -v or another executable banner can misclassify a patched distribution build.
Keep the relevant RHEL release and support coverage in your inventory, apply approved updates through the package manager, restart affected services and verify that active workloads use the fixed packages.