RPM records package names, versions, releases and architectures. Distributions such as Red Hat Enterprise Linux use RPM packages, commonly managed through higher-level tools such as DNF that resolve dependencies and obtain updates from repositories.
The release field matters for security. A distributor can backport a PHP fix into an older upstream version and publish a new RPM package release. A vulnerability check that reads only the PHP banner may miss the fixed distribution build.
Commands such as rpm -q can identify an installed package, while package metadata and vendor advisories help establish which vulnerabilities a given build addresses. The result still must be connected to the runtime actually serving requests.
Use the supported repository and package manager for updates. Keep the full package name, version, release and architecture in the patch record, then restart or redeploy the affected processes and verify the active build.